@@ -153,7 +153,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary server

-ENV NOTARY_COMMIT 8e8122eb5528f621afcd4e2854c47302f17392f7

+ENV NOTARY_COMMIT 30c488b3b4c62fdbc2c1eae7cf3b62ca73f95fad

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -11,6 +11,7 @@ import (

 	"net/http"

 	"net/url"

 	"os"

+	"path"

 	"path/filepath"

 	"regexp"

 	"sort"

@@ -35,9 +36,14 @@ import (

 	"github.com/docker/notary/passphrase"

 	"github.com/docker/notary/trustmanager"

 	"github.com/docker/notary/tuf/data"

+	"github.com/docker/notary/tuf/signed"

+	"github.com/docker/notary/tuf/store"

 )

-var untrusted bool

+var (

+	releasesRole = path.Join(data.CanonicalTargetsRole, "releases")

+	untrusted    bool

+)

 func addTrustedFlags(fs *flag.FlagSet, verify bool) {

 	var trusted bool

@@ -238,11 +244,11 @@ func (cli *DockerCli) trustedReference(ref reference.NamedTagged) (reference.Can

 		return nil, err

 	}

-	t, err := notaryRepo.GetTargetByName(ref.Tag())

+	t, err := notaryRepo.GetTargetByName(ref.Tag(), releasesRole, data.CanonicalTargetsRole)

 	if err != nil {

 		return nil, err

 	}

-	r, err := convertTarget(*t)

+	r, err := convertTarget(t.Target)

 	if err != nil {

 		return nil, err

@@ -264,17 +270,27 @@ func (cli *DockerCli) tagTrusted(trustedRef reference.Canonical, ref reference.N

 	return cli.client.ImageTag(options)

 }

-func notaryError(err error) error {

+func notaryError(repoName string, err error) error {

 	switch err.(type) {

 	case *json.SyntaxError:

 		logrus.Debugf("Notary syntax error: %s", err)

-		return errors.New("no trust data available for remote repository")

+		return fmt.Errorf("Error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address?", repoName)

 	case client.ErrExpired:

-		return fmt.Errorf("remote repository out-of-date: %v", err)

+		return fmt.Errorf("Error: remote repository %s out-of-date: %v", repoName, err)

 	case trustmanager.ErrKeyNotFound:

-		return fmt.Errorf("signing keys not found: %v", err)

+		return fmt.Errorf("Error: signing keys for remote repository %s not found: %v", repoName, err)

 	case *net.OpError:

-		return fmt.Errorf("error contacting notary server: %v", err)

+		return fmt.Errorf("Error: error contacting notary server: %v", err)

+	case store.ErrMetaNotFound:

+		return fmt.Errorf("Error: trust data missing for remote repository %s: %v", repoName, err)

+	case signed.ErrInvalidKeyType:

+		return fmt.Errorf("Error: trust data mismatch for remote repository %s, could be malicious behavior: %v", repoName, err)

+	case signed.ErrNoKeys:

+		return fmt.Errorf("Error: could not find signing keys for remote repository %s: %v", repoName, err)

+	case signed.ErrLowVersion:

+		return fmt.Errorf("Error: trust data version is lower than expected for remote repository %s, could be malicious behavior: %v", repoName, err)

+	case signed.ErrInsufficientSignatures:

+		return fmt.Errorf("Error: trust data has insufficient signatures for remote repository %s, could be malicious behavior: %v", repoName, err)

 	}

 	return err

@@ -291,12 +307,12 @@ func (cli *DockerCli) trustedPull(repoInfo *registry.RepositoryInfo, ref registr

 	if ref.String() == "" {

 		// List all targets

-		targets, err := notaryRepo.ListTargets()

+		targets, err := notaryRepo.ListTargets(releasesRole, data.CanonicalTargetsRole)

 		if err != nil {

-			return notaryError(err)

+			return notaryError(repoInfo.FullName(), err)

 		}

 		for _, tgt := range targets {

-			t, err := convertTarget(*tgt)

+			t, err := convertTarget(tgt.Target)

 			if err != nil {

 				fmt.Fprintf(cli.out, "Skipping target for %q\n", repoInfo.Name())

 				continue

@@ -304,11 +320,11 @@ func (cli *DockerCli) trustedPull(repoInfo *registry.RepositoryInfo, ref registr

 			refs = append(refs, t)

 		}

 	} else {

-		t, err := notaryRepo.GetTargetByName(ref.String())

+		t, err := notaryRepo.GetTargetByName(ref.String(), releasesRole, data.CanonicalTargetsRole)

 		if err != nil {

-			return notaryError(err)

+			return notaryError(repoInfo.FullName(), err)

 		}

-		r, err := convertTarget(*t)

+		r, err := convertTarget(t.Target)

 		if err != nil {

 			return err

@@ -413,7 +429,7 @@ func (cli *DockerCli) trustedPush(repoInfo *registry.RepositoryInfo, tag string,

 	repo, err := cli.getNotaryRepository(repoInfo, authConfig)

 	if err != nil {

-		fmt.Fprintf(cli.out, "Error establishing connection to notary repository: %s\n", err)

+		fmt.Fprintf(cli.out, "Error establishing connection to notary repository, has a notary server been setup and pointed to by the DOCKER_CONTENT_TRUST_SERVER environment variable?: %s\n", err)

 		return err

 	}

@@ -429,14 +445,14 @@ func (cli *DockerCli) trustedPush(repoInfo *registry.RepositoryInfo, tag string,

 			},

 			Length: int64(target.size),

 		}

-		if err := repo.AddTarget(t); err != nil {

+		if err := repo.AddTarget(t, releasesRole); err != nil {

 			return err

 		}

 	}

 	err = repo.Publish()

 	if _, ok := err.(*client.ErrRepoNotInitialized); !ok {

-		return notaryError(err)

+		return notaryError(repoInfo.FullName(), err)

 	}

 	keys := repo.CryptoService.ListKeys(data.CanonicalRootRole)

@@ -455,9 +471,9 @@ func (cli *DockerCli) trustedPush(repoInfo *registry.RepositoryInfo, tag string,

 	}

 	if err := repo.Initialize(rootKeyID); err != nil {

-		return notaryError(err)

+		return notaryError(repoInfo.FullName(), err)

 	}

 	fmt.Fprintf(cli.out, "Finished initializing %q\n", repoInfo.FullName())

-	return notaryError(repo.Publish())

+	return notaryError(repoInfo.FullName(), repo.Publish())

 }

@@ -46,7 +46,9 @@ clone git github.com/boltdb/bolt v1.1.0

 clone git github.com/docker/distribution 568bf038af6d65b376165d02886b1c7fcaef1f61

 clone git github.com/vbatts/tar-split v0.9.11

-clone git github.com/docker/notary 45de2828b5e0083bfb4e9a5a781eddb05e2ef9d0

+# get desired notary commit, might also need to be updated in Dockerfile

+clone git github.com/docker/notary 30c488b3b4c62fdbc2c1eae7cf3b62ca73f95fad

+

 clone git google.golang.org/grpc 174192fc93efcb188fc8f46ca447f0da606b6885 https://github.com/grpc/grpc-go.git

 clone git github.com/miekg/pkcs11 80f102b5cac759de406949c47f0928b99bd64cdf

 clone git github.com/jfrazelle/go v1.5.1-1

@@ -5805,7 +5805,7 @@ func (s *DockerTrustSuite) TestTrustedBuildUntrustedTag(c *check.C) {

 		c.Fatalf("Expected error on trusted build with untrusted tag: %s\n%s", err, out)

 	}

-	if !strings.Contains(out, fmt.Sprintf("no trust data available")) {

+	if !strings.Contains(out, fmt.Sprintf("trust data unavailable")) {

 		c.Fatalf("Unexpected output on trusted build with untrusted tag:\n%s", out)

 	}

 }

@@ -312,7 +312,7 @@ func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

 	s.trustedCmd(createCmd)

 	out, _, err := runCommandWithOutput(createCmd)

 	c.Assert(err, check.Not(check.IsNil))

-	c.Assert(string(out), checker.Contains, "no trust data available", check.Commentf("Missing expected output on trusted create:\n%s", out))

+	c.Assert(string(out), checker.Contains, "trust data unavailable", check.Commentf("Missing expected output on trusted create:\n%s", out))

 }

@@ -58,7 +58,7 @@ func (s *DockerTrustSuite) TestUntrustedPull(c *check.C) {

 	out, _, err := runCommandWithOutput(pullCmd)

 	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "no trust data available", check.Commentf(out))

+	c.Assert(string(out), checker.Contains, "trust data unavailable", check.Commentf(out))

 }

 func (s *DockerTrustSuite) TestPullWhenCertExpired(c *check.C) {

@@ -115,10 +115,17 @@ func (s *DockerTrustSuite) TestTrustedPush(c *check.C) {

 	out, _, err := runCommandWithOutput(pushCmd)

 	c.Assert(err, check.IsNil, check.Commentf("Error running trusted push: %s\n%s", err, out))

 	c.Assert(out, checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push"))

+

+	// Try pull after push

+	pullCmd := exec.Command(dockerBinary, "pull", repoName)

+	s.trustedCmd(pullCmd)

+	out, _, err = runCommandWithOutput(pullCmd)

+	c.Assert(err, check.IsNil, check.Commentf(out))

+	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

 }

 func (s *DockerTrustSuite) TestTrustedPushWithEnvPasswords(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)

+	repoName := fmt.Sprintf("%v/dockerclienv/trusted:latest", privateRegistryURL)

 	// tag the image and upload it to the private registry

 	dockerCmd(c, "tag", "busybox", repoName)

@@ -127,6 +134,13 @@ func (s *DockerTrustSuite) TestTrustedPushWithEnvPasswords(c *check.C) {

 	out, _, err := runCommandWithOutput(pushCmd)

 	c.Assert(err, check.IsNil, check.Commentf("Error running trusted push: %s\n%s", err, out))

 	c.Assert(out, checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push"))

+

+	// Try pull after push

+	pullCmd := exec.Command(dockerBinary, "pull", repoName)

+	s.trustedCmd(pullCmd)

+	out, _, err = runCommandWithOutput(pullCmd)

+	c.Assert(err, check.IsNil, check.Commentf(out))

+	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

 }

 // This test ensures backwards compatibility with old ENV variables. Should be

@@ -168,7 +182,7 @@ func (s *DockerTrustSuite) TestTrustedPushWithoutServerAndUntrusted(c *check.C)

 }

 func (s *DockerTrustSuite) TestTrustedPushWithExistingTag(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)

+	repoName := fmt.Sprintf("%v/dockerclitag/trusted:latest", privateRegistryURL)

 	// tag the image and upload it to the private registry

 	dockerCmd(c, "tag", "busybox", repoName)

 	dockerCmd(c, "push", repoName)

@@ -178,6 +192,13 @@ func (s *DockerTrustSuite) TestTrustedPushWithExistingTag(c *check.C) {

 	out, _, err := runCommandWithOutput(pushCmd)

 	c.Assert(err, check.IsNil, check.Commentf("trusted push failed: %s\n%s", err, out))

 	c.Assert(out, checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push with existing tag"))

+

+	// Try pull after push

+	pullCmd := exec.Command(dockerBinary, "pull", repoName)

+	s.trustedCmd(pullCmd)

+	out, _, err = runCommandWithOutput(pullCmd)

+	c.Assert(err, check.IsNil, check.Commentf(out))

+	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

 }

 func (s *DockerTrustSuite) TestTrustedPushWithExistingSignedTag(c *check.C) {

@@ -3087,7 +3087,7 @@ func (s *DockerTrustSuite) TestUntrustedRun(c *check.C) {

 		c.Fatalf("Error expected when running trusted run with:\n%s", out)

 	}

-	if !strings.Contains(string(out), "no trust data available") {

+	if !strings.Contains(string(out), "trust data unavailable") {

 		c.Fatalf("Missing expected output on trusted run:\n%s", out)

 	}

 }

@@ -28,9 +28,9 @@ const notaryURL = "https://" + notaryHost

 func newTestNotary(c *check.C) (*testNotary, error) {

 	template := `{

 	"server": {

-		"addr": "%s",

-		"tls_key_file": "fixtures/notary/localhost.key",

-		"tls_cert_file": "fixtures/notary/localhost.cert"

+		"http_addr": "%s",

+		"tls_key_file": "%s",

+		"tls_cert_file": "%s"

 	},

 	"trust_service": {

 		"type": "local",

@@ -39,8 +39,11 @@ func newTestNotary(c *check.C) (*testNotary, error) {

 		"key_algorithm": "ed25519"

 	},

 	"logging": {

-		"level": 5

-	}

+		"level": "debug"

+	},

+	"storage": {

+        "backend": "memory"

+    }

 }`

 	tmp, err := ioutil.TempDir("", "notary-test-")

 	if err != nil {

@@ -51,7 +54,12 @@ func newTestNotary(c *check.C) (*testNotary, error) {

 	if err != nil {

 		return nil, err

 	}

-	if _, err := fmt.Fprintf(config, template, notaryHost); err != nil {

+

+	workingDir, err := os.Getwd()

+	if err != nil {

+		return nil, err

+	}

+	if _, err := fmt.Fprintf(config, template, notaryHost, filepath.Join(workingDir, "fixtures/notary/localhost.key"), filepath.Join(workingDir, "fixtures/notary/localhost.cert")); err != nil {

 		os.RemoveAll(tmp)

 		return nil, err

 	}

@@ -20,4 +20,4 @@ RUN go install \

     ${NOTARYPKG}/cmd/notary-server

 ENTRYPOINT [ "notary-server" ]

-CMD [ "-config", "cmd/notary-server/config.json" ]

+CMD [ "-config=fixtures/server-config-local.json" ]

@@ -38,4 +38,4 @@ RUN go install \

 ENTRYPOINT [ "notary-signer" ]

-CMD [ "-config=cmd/notary-signer/config.json" ]

+CMD [ "-config=fixtures/signer-config-local.json" ]

@@ -1,5 +1,52 @@

-David Lawrence <david.lawrence@docker.com> (@endophage)

-Ying Li <ying.li@docker.com> (@cyli)

-Nathan McCauley <nathan.mccauley@docker.com> (@NathanMcCauley)

-Derek McGowan <derek@docker.com> (@dmcgowan)

-Diogo Monica <diogo@docker.com> (@diogomonica)

+# Notary maintainers file

+#

+# This file describes who runs the docker/notary project and how.

+# This is a living document - if you see something out of date or missing, speak up!

+#

+# It is structured to be consumable by both humans and programs.

+# To extract its contents programmatically, use any TOML-compliant parser.

+#

+# This file is compiled into the MAINTAINERS file in docker/opensource.

+#

+[Org]

+	[Org."Core maintainers"]

+		people = [

+			"cyli",

+			"diogomonica",

+			"dmcgowan",

+			"endophage",

+			"nathanmccauley",

+		]

+

+[people]

+

+# A reference list of all people associated with the project.

+# All other sections should refer to people by their canonical key

+# in the people section.

+

+	# ADD YOURSELF HERE IN ALPHABETICAL ORDER

+

+	[people.cyli]

+	Name = "Ying Li"

+	Email = "ying.li@docker.com"

+	GitHub = "cyli"

+

+	[people.diogomonica]

+	Name = "Diogo Monica"

+	Email = "diogo@docker.com"

+	GitHub = "diogomonica"

+

+	[people.dmcgowan]

+	Name = "Derek McGowan"

+	Email = "derek@docker.com"

+	GitHub = "dmcgowan"

+

+	[people.endophage]

+	Name = "David Lawrence"

+	Email = "david.lawrence@docker.com"

+	GitHub = "endophage"

+

+	[people.nathanmccauley]

+	Name = "Nathan McCauley"

+	Email = "nathan.mccauley@docker.com"

+	GitHub = "nathanmccauley"

@@ -32,7 +32,7 @@ _space := $(empty) $(empty)

 # go cover test variables

 COVERDIR=.cover

-COVERPROFILE=$(COVERDIR)/cover.out

+COVERPROFILE?=$(COVERDIR)/cover.out

 COVERMODE=count

 PKGS = $(shell go list ./... | tr '\n' ' ')

@@ -43,8 +43,8 @@ GO_VERSION = $(shell go version | awk '{print $$3}')

 .DEFAULT: default

 go_version:

-ifneq ("$(GO_VERSION)", "go1.5.1")

-	$(error Requires go version 1.5.1 - found $(GO_VERSION))

+ifeq (,$(findstring go1.5.,$(GO_VERSION)))

+	$(error Requires go version 1.5.x - found $(GO_VERSION))

 else

 	@echo

 endif

@@ -73,6 +73,11 @@ ${PREFIX}/bin/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')

 vet: go_version

 	@echo "+ $@"

+ifeq ($(shell uname -s), Darwin)

+	@test -z "$(shell find . -iname *test*.go | grep -v _test.go | grep -v Godeps | xargs echo "This file should end with '_test':"  | tee /dev/stderr)"

+else

+	@test -z "$(shell find . -iname *test*.go | grep -v _test.go | grep -v Godeps | xargs -r echo "This file should end with '_test':"  | tee /dev/stderr)"

+endif

 	@test -z "$$(go tool vet -printf=false . 2>&1 | grep -v Godeps/_workspace/src/ | tee /dev/stderr)"

 fmt:

@@ -1 +1 @@

-1.0-rc1

+0.2

@@ -87,7 +87,7 @@ curl example.com/install.sh | notary verify example.com/scripts v1 | sh

 # Notary Server

 Notary Server manages TUF data over an HTTP API compatible with the

-[notary client](../notary/).

+[notary client](cmd/notary).

 It may be configured to use either JWT or HTTP Basic Auth for authentication.

 Currently it only supports MySQL for storage of the TUF data, we intend to

new file mode 100644

@@ -0,0 +1,345 @@

+package certs

+

+import (

+	"crypto/x509"

+	"errors"

+	"fmt"

+	"path/filepath"

+	"time"

+

+	"github.com/Sirupsen/logrus"

+	"github.com/docker/notary/trustmanager"

+	"github.com/docker/notary/tuf/data"

+	"github.com/docker/notary/tuf/signed"

+)

+

+// Manager is an abstraction around trusted root CA stores

+type Manager struct {

+	trustedCAStore          trustmanager.X509Store

+	trustedCertificateStore trustmanager.X509Store

+}

+

+const trustDir = "trusted_certificates"

+

+// ErrValidationFail is returned when there is no valid trusted certificates

+// being served inside of the roots.json

+type ErrValidationFail struct {

+	Reason string

+}

+

+// ErrValidationFail is returned when there is no valid trusted certificates

+// being served inside of the roots.json

+func (err ErrValidationFail) Error() string {

+	return fmt.Sprintf("could not validate the path to a trusted root: %s", err.Reason)

+}

+

+// ErrRootRotationFail is returned when we fail to do a full root key rotation

+// by either failing to add the new root certificate, or delete the old ones

+type ErrRootRotationFail struct {

+	Reason string

+}

+

+// ErrRootRotationFail is returned when we fail to do a full root key rotation

+// by either failing to add the new root certificate, or delete the old ones

+func (err ErrRootRotationFail) Error() string {

+	return fmt.Sprintf("could not rotate trust to a new trusted root: %s", err.Reason)

+}

+

+// NewManager returns an initialized Manager, or an error

+// if it fails to load certificates

+func NewManager(baseDir string) (*Manager, error) {

+	trustPath := filepath.Join(baseDir, trustDir)

+

+	// Load all CAs that aren't expired and don't use SHA1

+	trustedCAStore, err := trustmanager.NewX509FilteredFileStore(trustPath, func(cert *x509.Certificate) bool {

+		return cert.IsCA && cert.BasicConstraintsValid && cert.SubjectKeyId != nil &&

+			time.Now().Before(cert.NotAfter) &&

+			cert.SignatureAlgorithm != x509.SHA1WithRSA &&

+			cert.SignatureAlgorithm != x509.DSAWithSHA1 &&

+			cert.SignatureAlgorithm != x509.ECDSAWithSHA1

+	})

+	if err != nil {

+		return nil, err

+	}

+

+	// Load all individual (non-CA) certificates that aren't expired and don't use SHA1

+	trustedCertificateStore, err := trustmanager.NewX509FilteredFileStore(trustPath, func(cert *x509.Certificate) bool {

+		return !cert.IsCA &&

+			time.Now().Before(cert.NotAfter) &&

+			cert.SignatureAlgorithm != x509.SHA1WithRSA &&

+			cert.SignatureAlgorithm != x509.DSAWithSHA1 &&

+			cert.SignatureAlgorithm != x509.ECDSAWithSHA1

+	})

+	if err != nil {

+		return nil, err

+	}

+

+	return &Manager{

+		trustedCAStore:          trustedCAStore,

+		trustedCertificateStore: trustedCertificateStore,

+	}, nil

+}

+

+// TrustedCertificateStore returns the trusted certificate store being managed

+// by this Manager

+func (m *Manager) TrustedCertificateStore() trustmanager.X509Store {

+	return m.trustedCertificateStore

+}

+

+// TrustedCAStore returns the CA store being managed by this Manager

+func (m *Manager) TrustedCAStore() trustmanager.X509Store {

+	return m.trustedCAStore

+}

+

+// AddTrustedCert adds a cert to the trusted certificate store (not the CA

+// store)

+func (m *Manager) AddTrustedCert(cert *x509.Certificate) {

+	m.trustedCertificateStore.AddCert(cert)

+}

+

+// AddTrustedCACert adds a cert to the trusted CA certificate store

+func (m *Manager) AddTrustedCACert(cert *x509.Certificate) {

+	m.trustedCAStore.AddCert(cert)

+}

+

+/*

+ValidateRoot receives a new root, validates its correctness and attempts to

+do root key rotation if needed.

+

+First we list the current trusted certificates we have for a particular GUN. If

+that list is non-empty means that we've already seen this repository before, and

+have a list of trusted certificates for it. In this case, we use this list of

+certificates to attempt to validate this root file.

+

+If the previous validation suceeds, or in the case where we found no trusted

+certificates for this particular GUN, we check the integrity of the root by

+making sure that it is validated by itself. This means that we will attempt to

+validate the root data with the certificates that are included in the root keys

+themselves.

+

+If this last steps succeeds, we attempt to do root rotation, by ensuring that

+we only trust the certificates that are present in the new root.

+

+This mechanism of operation is essentially Trust On First Use (TOFU): if we

+have never seen a certificate for a particular CN, we trust it. If later we see

+a different certificate for that certificate, we return an ErrValidationFailed error.

+

+Note that since we only allow trust data to be downloaded over an HTTPS channel

+we are using the current public PKI to validate the first download of the certificate

+adding an extra layer of security over the normal (SSH style) trust model.

+We shall call this: TOFUS.

+*/

+func (m *Manager) ValidateRoot(root *data.Signed, gun string) error {

+	logrus.Debugf("entered ValidateRoot with dns: %s", gun)

+	signedRoot, err := data.RootFromSigned(root)

+	if err != nil {

+		return err

+	}

+

+	// Retrieve all the leaf certificates in root for which the CN matches the GUN

+	allValidCerts, err := validRootLeafCerts(signedRoot, gun)

+	if err != nil {

+		logrus.Debugf("error retrieving valid leaf certificates for: %s, %v", gun, err)

+		return &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"}

+	}

+

+	// Retrieve all the trusted certificates that match this gun

+	certsForCN, err := m.trustedCertificateStore.GetCertificatesByCN(gun)

+	if err != nil {

+		// If the error that we get back is different than ErrNoCertificatesFound

+		// we couldn't check if there are any certificates with this CN already

+		// trusted. Let's take the conservative approach and return a failed validation

+		if _, ok := err.(*trustmanager.ErrNoCertificatesFound); !ok {

+			logrus.Debugf("error retrieving trusted certificates for: %s, %v", gun, err)

+			return &ErrValidationFail{Reason: "unable to retrieve trusted certificates"}

+		}

+	}

+

+	// If we have certificates that match this specific GUN, let's make sure to

+	// use them first to validate that this new root is valid.

+	if len(certsForCN) != 0 {

+		logrus.Debugf("found %d valid root certificates for %s", len(certsForCN), gun)

+		err = signed.VerifyRoot(root, 0, trustmanager.CertsToKeys(certsForCN))

+		if err != nil {

+			logrus.Debugf("failed to verify TUF data for: %s, %v", gun, err)

+			return &ErrValidationFail{Reason: "failed to validate data with current trusted certificates"}

+		}

+	} else {

+		logrus.Debugf("found no currently valid root certificates for %s", gun)

+	}

+

+	// Validate the integrity of the new root (does it have valid signatures)

+	err = signed.VerifyRoot(root, 0, trustmanager.CertsToKeys(allValidCerts))

+	if err != nil {

+		logrus.Debugf("failed to verify TUF data for: %s, %v", gun, err)

+		return &ErrValidationFail{Reason: "failed to validate integrity of roots"}

+	}

+

+	// Getting here means A) we had trusted certificates and both the

+	// old and new validated this root; or B) we had no trusted certificates but

+	// the new set of certificates has integrity (self-signed)

+	logrus.Debugf("entering root certificate rotation for: %s", gun)

+

+	// Do root certificate rotation: we trust only the certs present in the new root

+	// First we add all the new certificates (even if they already exist)

+	for _, cert := range allValidCerts {

+		err := m.trustedCertificateStore.AddCert(cert)

+		if err != nil {

+			// If the error is already exists we don't fail the rotation

+			if _, ok := err.(*trustmanager.ErrCertExists); ok {

+				logrus.Debugf("ignoring certificate addition to: %s", gun)

+				continue

+			}

+			logrus.Debugf("error adding new trusted certificate for: %s, %v", gun, err)

+		}

+	}

+

+	// Now we delete old certificates that aren't present in the new root

+	for certID, cert := range certsToRemove(certsForCN, allValidCerts) {

+		logrus.Debugf("removing certificate with certID: %s", certID)

+		err = m.trustedCertificateStore.RemoveCert(cert)

+		if err != nil {

+			logrus.Debugf("failed to remove trusted certificate with keyID: %s, %v", certID, err)

+			return &ErrRootRotationFail{Reason: "failed to rotate root keys"}

+		}

+	}

+

+	logrus.Debugf("Root validation succeeded for %s", gun)

+	return nil

+}

+

+// validRootLeafCerts returns a list of non-exipired, non-sha1 certificates whoose

+// Common-Names match the provided GUN

+func validRootLeafCerts(root *data.SignedRoot, gun string) ([]*x509.Certificate, error) {

+	// Get a list of all of the leaf certificates present in root

+	allLeafCerts, _ := parseAllCerts(root)

+	var validLeafCerts []*x509.Certificate

+

+	// Go through every leaf certificate and check that the CN matches the gun

+	for _, cert := range allLeafCerts {

+		// Validate that this leaf certificate has a CN that matches the exact gun

+		if cert.Subject.CommonName != gun {

+			logrus.Debugf("error leaf certificate CN: %s doesn't match the given GUN: %s", cert.Subject.CommonName)

+			continue

+		}

+		// Make sure the certificate is not expired

+		if time.Now().After(cert.NotAfter) {

+			logrus.Debugf("error leaf certificate is expired")

+			continue

+		}

+

+		// We don't allow root certificates that use SHA1

+		if cert.SignatureAlgorithm == x509.SHA1WithRSA ||

+			cert.SignatureAlgorithm == x509.DSAWithSHA1 ||

+			cert.SignatureAlgorithm == x509.ECDSAWithSHA1 {

+

+			logrus.Debugf("error certificate uses deprecated hashing algorithm (SHA1)")

+			continue

+		}

+

+		validLeafCerts = append(validLeafCerts, cert)

+	}

+

+	if len(validLeafCerts) < 1 {

+		logrus.Debugf("didn't find any valid leaf certificates for %s", gun)

+		return nil, errors.New("no valid leaf certificates found in any of the root keys")

+	}

+

+	logrus.Debugf("found %d valid leaf certificates for %s", len(validLeafCerts), gun)

+	return validLeafCerts, nil

+}

+

+// parseAllCerts returns two maps, one with all of the leafCertificates and one

+// with all the intermediate certificates found in signedRoot

+func parseAllCerts(signedRoot *data.SignedRoot) (map[string]*x509.Certificate, map[string][]*x509.Certificate) {

+	leafCerts := make(map[string]*x509.Certificate)

+	intCerts := make(map[string][]*x509.Certificate)

+

+	// Before we loop through all root keys available, make sure any exist

+	rootRoles, ok := signedRoot.Signed.Roles["root"]

+	if !ok {

+		logrus.Debugf("tried to parse certificates from invalid root signed data")

+		return nil, nil

+	}

+

+	logrus.Debugf("found the following root keys: %v", rootRoles.KeyIDs)

+	// Iterate over every keyID for the root role inside of roots.json

+	for _, keyID := range rootRoles.KeyIDs {

+		// check that the key exists in the signed root keys map

+		key, ok := signedRoot.Signed.Keys[keyID]

+		if !ok {

+			logrus.Debugf("error while getting data for keyID: %s", keyID)

+			continue

+		}

+

+		// Decode all the x509 certificates that were bundled with this

+		// Specific root key

+		decodedCerts, err := trustmanager.LoadCertBundleFromPEM(key.Public())

+		if err != nil {

+			logrus.Debugf("error while parsing root certificate with keyID: %s, %v", keyID, err)

+			continue

+		}

+

+		// Get all non-CA certificates in the decoded certificates

+		leafCertList := trustmanager.GetLeafCerts(decodedCerts)

+

+		// If we got no leaf certificates or we got more than one, fail

+		if len(leafCertList) != 1 {

+			logrus.Debugf("invalid chain due to leaf certificate missing or too many leaf certificates for keyID: %s", keyID)

+			continue

+		}

+

+		// Get the ID of the leaf certificate

+		leafCert := leafCertList[0]

+		leafID, err := trustmanager.FingerprintCert(leafCert)

+		if err != nil {

+			logrus.Debugf("error while fingerprinting root certificate with keyID: %s, %v", keyID, err)

+			continue

+		}

+

+		// Store the leaf cert in the map

+		leafCerts[leafID] = leafCert

+

+		// Get all the remainder certificates marked as a CA to be used as intermediates

+		intermediateCerts := trustmanager.GetIntermediateCerts(decodedCerts)

+		intCerts[leafID] = intermediateCerts

+	}

+

+	return leafCerts, intCerts

+}

+

+// certsToRemove returns all the certifificates from oldCerts that aren't present

+// in newCerts

+func certsToRemove(oldCerts, newCerts []*x509.Certificate) map[string]*x509.Certificate {

+	certsToRemove := make(map[string]*x509.Certificate)

+

+	// If no newCerts were provided

+	if len(newCerts) == 0 {

+		return certsToRemove

+	}

+

+	// Populate a map with all the IDs from newCert

+	var newCertMap = make(map[string]struct{})

+	for _, cert := range newCerts {

+		certID, err := trustmanager.FingerprintCert(cert)

+		if err != nil {

+			logrus.Debugf("error while fingerprinting root certificate with keyID: %s, %v", certID, err)

+			continue

+		}

+		newCertMap[certID] = struct{}{}

+	}

+

+	// Iterate over all the old certificates and check to see if we should remove them

+	for _, cert := range oldCerts {

+		certID, err := trustmanager.FingerprintCert(cert)

+		if err != nil {

+			logrus.Debugf("error while fingerprinting root certificate with certID: %s, %v", certID, err)

+			continue

+		}

+		if _, ok := newCertMap[certID]; !ok {

+			certsToRemove[certID] = cert

+		}

+	}

+

+	return certsToRemove

+}

@@ -16,6 +16,8 @@ machine:

     BASE_STABLE: ../../../$HOME/.gvm/pkgsets/stable/global/$BASE_DIR

   # Workaround Circle parsing dumb bugs and/or YAML wonkyness

     CIRCLE_PAIN: "mode: set"

+  # Put the coverage profile somewhere codecov's script can find it

+    COVERPROFILE: coverage.out

   hosts:

   # Not used yet

@@ -72,8 +74,10 @@ test:

   post:

     - gvm use stable && make covmerge:

         timeout: 600

+        parallel: true

         pwd: $BASE_STABLE

   # Report to codecov.io

-    # - bash <(curl -s https://codecov.io/bash):

-    #     pwd: $BASE_STABLE

+    - bash <(curl -s https://codecov.io/bash):

+        parallel: true

+        pwd: $BASE_STABLE

@@ -77,3 +77,26 @@ func (c TufChange) Path() string {

 func (c TufChange) Content() []byte {

 	return c.Data

 }

+

+// TufDelegation represents a modification to a target delegation

+// this includes creating a delegations. This format is used to avoid

+// unexpected race conditions between humans modifying the same delegation

+type TufDelegation struct {

+	NewName                string       `json:"new_name,omitempty"`

+	NewThreshold           int          `json:"threshold, omitempty"`

+	AddKeys                data.KeyList `json:"add_keys, omitempty"`

+	RemoveKeys             []string     `json:"remove_keys,omitempty"`

+	AddPaths               []string     `json:"add_paths,omitempty"`

+	RemovePaths            []string     `json:"remove_paths,omitempty"`

+	AddPathHashPrefixes    []string     `json:"add_prefixes,omitempty"`

+	RemovePathHashPrefixes []string     `json:"remove_prefixes,omitempty"`

+}

+

+// ToNewRole creates a fresh role object from the TufDelegation data

+func (td TufDelegation) ToNewRole(scope string) (*data.Role, error) {

+	name := scope

+	if td.NewName != "" {

+		name = td.NewName

+	}

+	return data.NewRole(name, td.NewThreshold, td.AddKeys.IDs(), td.AddPaths, td.AddPathHashPrefixes)

+}

@@ -9,11 +9,13 @@ import (

 	"net/http"

 	"os"

 	"path/filepath"

+	"strings"

+	"time"

 	"github.com/Sirupsen/logrus"

+	"github.com/docker/notary/certs"

 	"github.com/docker/notary/client/changelist"

 	"github.com/docker/notary/cryptoservice"

-	"github.com/docker/notary/keystoremanager"

 	"github.com/docker/notary/trustmanager"

 	"github.com/docker/notary/tuf"

 	tufclient "github.com/docker/notary/tuf/client"

@@ -52,6 +54,17 @@ type ErrExpired struct {

 	signed.ErrExpired

 }

+// ErrInvalidRemoteRole is returned when the server is requested to manage

+// an unsupported key type

+type ErrInvalidRemoteRole struct {

+	Role string

+}

+

+func (e ErrInvalidRemoteRole) Error() string {

+	return fmt.Sprintf(

+		"notary does not support the server managing the %s key", e.Role)

+}

+

 const (

 	tufDir = "tuf"

 )

@@ -63,23 +76,67 @@ var ErrRepositoryNotExist = errors.New("repository does not exist")

 // NotaryRepository stores all the information needed to operate on a notary

 // repository.

 type NotaryRepository struct {

-	baseDir         string

-	gun             string

-	baseURL         string

-	tufRepoPath     string

-	fileStore       store.MetadataStore

-	CryptoService   signed.CryptoService

-	tufRepo         *tuf.Repo

-	roundTrip       http.RoundTripper

-	KeyStoreManager *keystoremanager.KeyStoreManager