@@ -91,7 +91,7 @@ clone git github.com/boltdb/bolt fff57c100f4dea1905678da7e90d92429dff2904

 clone git github.com/miekg/dns 75e6e86cc601825c5dbcd4e0c209eab180997cd7

 # get graph and distribution packages

-clone git github.com/docker/distribution 77b9d2997abcded79a5314970fe69a44c93c25fb

+clone git github.com/docker/distribution fbb70dc3a14ca65cdac3aaf5e5122b03b42f6fbc

 clone git github.com/vbatts/tar-split v0.10.1

 # get go-zfs packages

@@ -11,7 +11,7 @@ Most people should use the [official Registry docker image](https://hub.docker.c

 People looking for advanced operational use cases might consider rolling their own image with a custom Dockerfile inheriting `FROM registry:2`.

-OS X users who want to run natively can do so following [the instructions here](osx-setup-guide.md).

+OS X users who want to run natively can do so following [the instructions here](https://github.com/docker/docker.github.io/blob/master/registry/recipes/osx-setup-guide.md).

 ### Gotchas

new file mode 100644

@@ -0,0 +1,8 @@

+// Only run on Linux atm

+wrappedNode(label: 'docker') {

+  deleteDir()

+  stage "checkout"

+  checkout scm

+

+  documentationChecker("docs")

+}

@@ -27,22 +27,25 @@ version/version.go:

 # Required for go 1.5 to build

 GO15VENDOREXPERIMENT := 1

+# Go files

+GOFILES=$(shell find . -type f -name '*.go')

+

 # Package list

-PKGS := $(shell go list -tags "${DOCKER_BUILDTAGS}" ./... | grep -v ^github.com/docker/distribution/vendor/)

+PKGS=$(shell go list -tags "${DOCKER_BUILDTAGS}" ./... | grep -v ^github.com/docker/distribution/vendor/)

 # Resolving binary dependencies for specific targets

-GOLINT := $(shell which golint || echo '')

-GODEP := $(shell which godep || echo '')

+GOLINT=$(shell which golint || echo '')

+GODEP=$(shell which godep || echo '')

-${PREFIX}/bin/registry: $(wildcard **/*.go)

+${PREFIX}/bin/registry: $(GOFILES)

 	@echo "+ $@"

 	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/registry

-${PREFIX}/bin/digest:  $(wildcard **/*.go)

+${PREFIX}/bin/digest:  $(GOFILES)

 	@echo "+ $@"

 	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/digest

-${PREFIX}/bin/registry-api-descriptor-template: $(wildcard **/*.go)

+${PREFIX}/bin/registry-api-descriptor-template: $(GOFILES)

 	@echo "+ $@"

 	@go build -o $@ ${GO_LDFLAGS} ${GO_GCFLAGS} ./cmd/registry-api-descriptor-template

@@ -19,7 +19,7 @@ This repository contains the following components:

 | **registry**       | An implementation of the [Docker Registry HTTP API V2](docs/spec/api.md) for use with docker 1.6+.                                                                                                  |

 | **libraries**      | A rich set of libraries for interacting with distribution components. Please see [godoc](https://godoc.org/github.com/docker/distribution) for details. **Note**: These libraries are **unstable**. |

 | **specifications** | _Distribution_ related specifications are available in [docs/spec](docs/spec)                                                                                                                        |

-| **documentation**  | Docker's full documentation set is available at [docs.docker.com](https://docs.docker.com). This repository [contains the subset](docs/index.md) related just to the registry.                                                                                                                                          |

+| **documentation**  | Docker's full documentation set is available at [docs.docker.com](https://docs.docker.com). This repository [contains the subset](docs/) related just to the registry.                                                                                                                                          |

 ### How does this integrate with Docker engine?

@@ -60,15 +60,15 @@ For information on upcoming functionality, please see [ROADMAP.md](ROADMAP.md).

 By default, Docker users pull images from Docker's public registry instance.

 [Installing Docker](https://docs.docker.com/engine/installation/) gives users this

 ability. Users can also push images to a repository on Docker's public registry,

-if they have a [Docker Hub](https://hub.docker.com/) account. 

+if they have a [Docker Hub](https://hub.docker.com/) account.

 For some users and even companies, this default behavior is sufficient. For

-others, it is not. 

+others, it is not.

 For example, users with their own software products may want to maintain a

 registry for private, company images. Also, you may wish to deploy your own

 image repository for images used to test or in continuous integration. For these

-use cases and others, [deploying your own registry instance](docs/deploying.md)

+use cases and others, [deploying your own registry instance](https://github.com/docker/docker.github.io/blob/master/registry/deploying.md)

 may be the better choice.

 ### Migration to Registry 2.0

@@ -83,7 +83,7 @@ created. For more information see [docker/migrator]

 Please see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute

 issues, fixes, and patches to this project. If you are contributing code, see

-the instructions for [building a development environment](docs/recipes/building.md).

+the instructions for [building a development environment](BUILDING.md).

 ## Support

@@ -9,11 +9,10 @@ import (

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/context"

-	"github.com/docker/distribution/reference"

-	"github.com/docker/libtrust"

-

 	"github.com/docker/distribution/digest"

 	"github.com/docker/distribution/manifest"

+	"github.com/docker/distribution/reference"

+	"github.com/docker/libtrust"

 )

 type diffID digest.Digest

@@ -95,7 +94,7 @@ func (mb *configManifestBuilder) Build(ctx context.Context) (m distribution.Mani

 	}

 	if len(img.RootFS.DiffIDs) != len(mb.descriptors) {

-		return nil, errors.New("number of descriptors and number of layers in rootfs must match")

+		return nil, fmt.Errorf("number of descriptors and number of layers in rootfs must match: len(%v) != len(%v)", img.RootFS.DiffIDs, mb.descriptors)

 	}

 	// Generate IDs for each layer

@@ -18,7 +18,7 @@ const (

 	MediaTypeConfig = "application/vnd.docker.container.image.v1+json"

 	// MediaTypePluginConfig specifies the mediaType for plugin configuration.

-	MediaTypePluginConfig = "application/vnd.docker.plugin.v0+json"

+	MediaTypePluginConfig = "application/vnd.docker.plugin.image.v0+json"

 	// MediaTypeLayer is the mediaType used for layers referenced by the

 	// manifest.

@@ -69,7 +69,10 @@ type Manifest struct {

 // References returnes the descriptors of this manifests references.

 func (m Manifest) References() []distribution.Descriptor {

-	return m.Layers

+	references := make([]distribution.Descriptor, 0, 1+len(m.Layers))

+	references = append(references, m.Config)

+	references = append(references, m.Layers...)

+	return references

 }

 // Target returns the target of this signed manifest.

@@ -12,8 +12,13 @@ import (

 // references and an optional target

 type Manifest interface {

 	// References returns a list of objects which make up this manifest.

-	// The references are strictly ordered from base to head. A reference

-	// is anything which can be represented by a distribution.Descriptor

+	// A reference is anything which can be represented by a

+	// distribution.Descriptor. These can consist of layers, resources or other

+	// manifests.

+	//

+	// While no particular order is required, implementations should return

+	// them from highest to lowest priority. For example, one might want to

+	// return the base layer before the top layer.

 	References() []Descriptor

 	// Payload provides the serialized format of the manifest, in addition to

@@ -36,6 +41,9 @@ type ManifestBuilder interface {

 	// AppendReference includes the given object in the manifest after any

 	// existing dependencies. If the add fails, such as when adding an

 	// unsupported dependency, an error may be returned.

+	//

+	// The destination of the reference is dependent on the manifest type and

+	// the dependency type.

 	AppendReference(dependency Describable) error

 }

@@ -24,6 +24,7 @@ package reference

 import (

 	"errors"

 	"fmt"

+	"strings"

 	"github.com/docker/distribution/digest"

 )

@@ -43,6 +44,9 @@ var (

 	// ErrDigestInvalidFormat represents an error while trying to parse a string as a tag.

 	ErrDigestInvalidFormat = errors.New("invalid digest format")

+	// ErrNameContainsUppercase is returned for invalid repository names that contain uppercase characters.

+	ErrNameContainsUppercase = errors.New("repository name must be lowercase")

+

 	// ErrNameEmpty is returned for empty, invalid repository names.

 	ErrNameEmpty = errors.New("repository name must have at least one component")

@@ -134,7 +138,7 @@ type Canonical interface {

 func SplitHostname(named Named) (string, string) {

 	name := named.Name()

 	match := anchoredNameRegexp.FindStringSubmatch(name)

-	if match == nil || len(match) != 3 {

+	if len(match) != 3 {

 		return "", name

 	}

 	return match[1], match[2]

@@ -149,7 +153,9 @@ func Parse(s string) (Reference, error) {

 		if s == "" {

 			return nil, ErrNameEmpty

 		}

-		// TODO(dmcgowan): Provide more specific and helpful error

+		if ReferenceRegexp.FindStringSubmatch(strings.ToLower(s)) != nil {

+			return nil, ErrNameContainsUppercase

+		}

 		return nil, ErrReferenceInvalidFormat

 	}

new file mode 100644

@@ -0,0 +1,27 @@

+package auth

+

+import (

+	"net/url"

+	"strings"

+)

+

+// FROM: https://golang.org/src/net/http/http.go

+// Given a string of the form "host", "host:port", or "[ipv6::address]:port",

+// return true if the string includes a port.

+func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }

+

+// FROM: http://golang.org/src/net/http/transport.go

+var portMap = map[string]string{

+	"http":  "80",

+	"https": "443",

+}

+

+// canonicalAddr returns url.Host but always with a ":port" suffix

+// FROM: http://golang.org/src/net/http/transport.go

+func canonicalAddr(url *url.URL) string {

+	addr := url.Host

+	if !hasPort(addr) {

+		return addr + ":" + portMap[url.Scheme]

+	}

+	return addr

+}

@@ -5,6 +5,7 @@ import (

 	"net/http"

 	"net/url"

 	"strings"

+	"sync"

 )

 // Challenge carries information from a WWW-Authenticate response header.

@@ -43,29 +44,45 @@ type ChallengeManager interface {

 // perform requests on the endpoints or cache the responses

 // to a backend.

 func NewSimpleChallengeManager() ChallengeManager {

-	return simpleChallengeManager{}

+	return &simpleChallengeManager{

+		Challanges: make(map[string][]Challenge),

+	}

 }

-type simpleChallengeManager map[string][]Challenge

+type simpleChallengeManager struct {

+	sync.RWMutex

+	Challanges map[string][]Challenge

+}

-func (m simpleChallengeManager) GetChallenges(endpoint url.URL) ([]Challenge, error) {

+func normalizeURL(endpoint *url.URL) {

 	endpoint.Host = strings.ToLower(endpoint.Host)

+	endpoint.Host = canonicalAddr(endpoint)

+}

-	challenges := m[endpoint.String()]

+func (m *simpleChallengeManager) GetChallenges(endpoint url.URL) ([]Challenge, error) {

+	normalizeURL(&endpoint)

+

+	m.RLock()

+	defer m.RUnlock()

+	challenges := m.Challanges[endpoint.String()]

 	return challenges, nil

 }

-func (m simpleChallengeManager) AddResponse(resp *http.Response) error {

+func (m *simpleChallengeManager) AddResponse(resp *http.Response) error {

 	challenges := ResponseChallenges(resp)

 	if resp.Request == nil {

 		return fmt.Errorf("missing request reference")

 	}

 	urlCopy := url.URL{

 		Path:   resp.Request.URL.Path,

-		Host:   strings.ToLower(resp.Request.URL.Host),

+		Host:   resp.Request.URL.Host,

 		Scheme: resp.Request.URL.Scheme,

 	}

-	m[urlCopy.String()] = challenges

+	normalizeURL(&urlCopy)

+

+	m.Lock()

+	defer m.Unlock()

+	m.Challanges[urlCopy.String()] = challenges

 	return nil

 }

@@ -301,18 +301,20 @@ func (t *tags) Get(ctx context.Context, tag string) (distribution.Descriptor, er

 		return distribution.Descriptor{}, err

 	}

-	req, err := http.NewRequest("HEAD", u, nil)

-	if err != nil {

-		return distribution.Descriptor{}, err

-	}

+	newRequest := func(method string) (*http.Response, error) {

+		req, err := http.NewRequest(method, u, nil)

+		if err != nil {

+			return nil, err

+		}

-	for _, t := range distribution.ManifestMediaTypes() {

-		req.Header.Add("Accept", t)

+		for _, t := range distribution.ManifestMediaTypes() {

+			req.Header.Add("Accept", t)

+		}

+		resp, err := t.client.Do(req)

+		return resp, err

 	}

-	var attempts int

-	resp, err := t.client.Do(req)

-check:

+	resp, err := newRequest("HEAD")

 	if err != nil {

 		return distribution.Descriptor{}, err

 	}

@@ -321,23 +323,20 @@ check:

 	switch {

 	case resp.StatusCode >= 200 && resp.StatusCode < 400:

 		return descriptorFromResponse(resp)

-	case resp.StatusCode == http.StatusMethodNotAllowed:

-		req, err = http.NewRequest("GET", u, nil)

+	default:

+		// if the response is an error - there will be no body to decode.

+		// Issue a GET request:

+		//   - for data from a server that does not handle HEAD

+		//   - to get error details in case of a failure

+		resp, err = newRequest("GET")

 		if err != nil {

 			return distribution.Descriptor{}, err

 		}

+		defer resp.Body.Close()

-		for _, t := range distribution.ManifestMediaTypes() {

-			req.Header.Add("Accept", t)

-		}

-

-		resp, err = t.client.Do(req)

-		attempts++

-		if attempts > 1 {

-			return distribution.Descriptor{}, err

+		if resp.StatusCode >= 200 && resp.StatusCode < 400 {

+			return descriptorFromResponse(resp)

 		}

-		goto check

-	default:

 		return distribution.Descriptor{}, HandleErrorResponse(resp)

 	}

 }

@@ -181,6 +181,7 @@ func (hrs *httpReadSeeker) reader() (io.Reader, error) {

 		// context.GetLogger(hrs.context).Infof("Range: %s", req.Header.Get("Range"))

 	}

+	req.Header.Add("Accept-Encoding", "identity")

 	resp, err := hrs.client.Do(req)

 	if err != nil {

 		return nil, err

@@ -77,37 +77,46 @@ type repositoryScopedInMemoryBlobDescriptorCache struct {

 }

 func (rsimbdcp *repositoryScopedInMemoryBlobDescriptorCache) Stat(ctx context.Context, dgst digest.Digest) (distribution.Descriptor, error) {

-	if rsimbdcp.repository == nil {

+	rsimbdcp.parent.mu.Lock()

+	repo := rsimbdcp.repository

+	rsimbdcp.parent.mu.Unlock()

+

+	if repo == nil {

 		return distribution.Descriptor{}, distribution.ErrBlobUnknown

 	}

-	return rsimbdcp.repository.Stat(ctx, dgst)

+	return repo.Stat(ctx, dgst)

 }

 func (rsimbdcp *repositoryScopedInMemoryBlobDescriptorCache) Clear(ctx context.Context, dgst digest.Digest) error {

-	if rsimbdcp.repository == nil {

+	rsimbdcp.parent.mu.Lock()

+	repo := rsimbdcp.repository

+	rsimbdcp.parent.mu.Unlock()

+

+	if repo == nil {

 		return distribution.ErrBlobUnknown

 	}

-	return rsimbdcp.repository.Clear(ctx, dgst)

+	return repo.Clear(ctx, dgst)

 }

 func (rsimbdcp *repositoryScopedInMemoryBlobDescriptorCache) SetDescriptor(ctx context.Context, dgst digest.Digest, desc distribution.Descriptor) error {

-	if rsimbdcp.repository == nil {

+	rsimbdcp.parent.mu.Lock()

+	repo := rsimbdcp.repository

+	if repo == nil {

 		// allocate map since we are setting it now.

-		rsimbdcp.parent.mu.Lock()

 		var ok bool

 		// have to read back value since we may have allocated elsewhere.

-		rsimbdcp.repository, ok = rsimbdcp.parent.repositories[rsimbdcp.repo]

+		repo, ok = rsimbdcp.parent.repositories[rsimbdcp.repo]

 		if !ok {

-			rsimbdcp.repository = newMapBlobDescriptorCache()

-			rsimbdcp.parent.repositories[rsimbdcp.repo] = rsimbdcp.repository

+			repo = newMapBlobDescriptorCache()

+			rsimbdcp.parent.repositories[rsimbdcp.repo] = repo

 		}

-

-		rsimbdcp.parent.mu.Unlock()

+		rsimbdcp.repository = repo

 	}

+	rsimbdcp.parent.mu.Unlock()

-	if err := rsimbdcp.repository.SetDescriptor(ctx, dgst, desc); err != nil {

+	if err := repo.SetDescriptor(ctx, dgst, desc); err != nil {

 		return err

 	}