@@ -91,21 +91,6 @@ RUN set -x \

-FROM base AS notary

-# Install notary and notary-server

-ENV NOTARY_VERSION v0.5.0

-RUN set -x \

-	&& export GOPATH="$(mktemp -d)" \

-	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

-	&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \

-	&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \

-		go build -buildmode=pie -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \

-	&& GOPATH="$GOPATH/src/github.com/docker/notary/vendor:$GOPATH" \

-		go build -buildmode=pie -o /usr/local/bin/notary github.com/docker/notary/cmd/notary \

-	&& rm -rf "$GOPATH"

-

-

-

 FROM base AS docker-py

 # Get the "docker-py" source so we can run their integration tests

 ENV DOCKER_PY_COMMIT 8b246db271a85d6541dc458838627e89c683e42f

@@ -248,7 +233,6 @@ COPY --from=containerd /opt/containerd/ /usr/local/bin/

 COPY --from=proxy /opt/proxy/ /usr/local/bin/

 COPY --from=dockercli /opt/dockercli /usr/local/cli

 COPY --from=registry /usr/local/bin/registry* /usr/local/bin/

-COPY --from=notary /usr/local/bin/notary* /usr/local/bin/

 COPY --from=criu /opt/criu/ /usr/local/

 COPY --from=docker-py /docker-py /docker-py

 # TODO: This is for the docker-py tests, which shouldn't really be needed for

@@ -14,7 +14,6 @@ import (

 	"time"

 	"github.com/docker/docker/api/types/swarm"

-	"github.com/docker/docker/cli/config"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/integration-cli/cli"

 	"github.com/docker/docker/integration-cli/cli/build/fakestorage"

@@ -387,74 +386,6 @@ func (s *DockerSwarmSuite) TearDownTest(c *check.C) {

 }

 func init() {

-	check.Suite(&DockerTrustSuite{

-		ds: &DockerSuite{},

-	})

-}

-

-type DockerTrustSuite struct {

-	ds  *DockerSuite

-	reg *registry.V2

-	not *testNotary

-}

-

-func (s *DockerTrustSuite) OnTimeout(c *check.C) {

-	s.ds.OnTimeout(c)

-}

-

-func (s *DockerTrustSuite) SetUpTest(c *check.C) {

-	testRequires(c, registry.Hosting, NotaryServerHosting)

-	s.reg = setupRegistry(c, false, "", "")

-	s.not = setupNotary(c)

-}

-

-func (s *DockerTrustSuite) TearDownTest(c *check.C) {

-	if s.reg != nil {

-		s.reg.Close()

-	}

-	if s.not != nil {

-		s.not.Close()

-	}

-

-	// Remove trusted keys and metadata after test

-	os.RemoveAll(filepath.Join(config.Dir(), "trust"))

-	s.ds.TearDownTest(c)

-}

-

-func init() {

-	ds := &DockerSuite{}

-	check.Suite(&DockerTrustedSwarmSuite{

-		trustSuite: DockerTrustSuite{

-			ds: ds,

-		},

-		swarmSuite: DockerSwarmSuite{

-			ds: ds,

-		},

-	})

-}

-

-type DockerTrustedSwarmSuite struct {

-	swarmSuite DockerSwarmSuite

-	trustSuite DockerTrustSuite

-	reg        *registry.V2

-	not        *testNotary

-}

-

-func (s *DockerTrustedSwarmSuite) SetUpTest(c *check.C) {

-	s.swarmSuite.SetUpTest(c)

-	s.trustSuite.SetUpTest(c)

-}

-

-func (s *DockerTrustedSwarmSuite) TearDownTest(c *check.C) {

-	s.trustSuite.TearDownTest(c)

-	s.swarmSuite.TearDownTest(c)

-}

-

-func (s *DockerTrustedSwarmSuite) OnTimeout(c *check.C) {

-	s.swarmSuite.OnTimeout(c)

-}

-

-func init() {

 	check.Suite(&DockerPluginSuite{

 		ds: &DockerSuite{},

 	})

@@ -4048,140 +4048,6 @@ func (s *DockerSuite) TestBuildRUNErrMsg(c *check.C) {

 	})

 }

-func (s *DockerTrustSuite) TestTrustedBuild(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-build")

-	dockerFile := fmt.Sprintf(`

-  FROM %s

-  RUN []

-    `, repoName)

-

-	name := "testtrustedbuild"

-

-	buildImage(name, trustedBuild, build.WithDockerfile(dockerFile)).Assert(c, icmd.Expected{

-		Out: fmt.Sprintf("FROM %s@sha", repoName[:len(repoName)-7]),

-	})

-

-	// We should also have a tag reference for the image.

-	dockerCmd(c, "inspect", repoName)

-

-	// We should now be able to remove the tag reference.

-	dockerCmd(c, "rmi", repoName)

-}

-

-func (s *DockerTrustSuite) TestTrustedBuildUntrustedTag(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercli/build-untrusted-tag:latest", privateRegistryURL)

-	dockerFile := fmt.Sprintf(`

-  FROM %s

-  RUN []

-    `, repoName)

-

-	name := "testtrustedbuilduntrustedtag"

-

-	buildImage(name, trustedBuild, build.WithDockerfile(dockerFile)).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "does not have trust data for",

-	})

-}

-

-// FIXME(vdemeester) should migrate to docker/cli e2e tests

-func (s *DockerTrustSuite) TestBuildContextDirIsSymlink(c *check.C) {

-	testRequires(c, DaemonIsLinux)

-	tempDir, err := ioutil.TempDir("", "test-build-dir-is-symlink-")

-	c.Assert(err, check.IsNil)

-	defer os.RemoveAll(tempDir)

-

-	// Make a real context directory in this temp directory with a simple

-	// Dockerfile.

-	realContextDirname := filepath.Join(tempDir, "context")

-	if err := os.Mkdir(realContextDirname, os.FileMode(0755)); err != nil {

-		c.Fatal(err)

-	}

-

-	if err = ioutil.WriteFile(

-		filepath.Join(realContextDirname, "Dockerfile"),

-		[]byte(`

-			FROM busybox

-			RUN echo hello world

-		`),

-		os.FileMode(0644),

-	); err != nil {

-		c.Fatal(err)

-	}

-

-	// Make a symlink to the real context directory.

-	contextSymlinkName := filepath.Join(tempDir, "context_link")

-	if err := os.Symlink(realContextDirname, contextSymlinkName); err != nil {

-		c.Fatal(err)

-	}

-

-	// Executing the build with the symlink as the specified context should

-	// *not* fail.

-	dockerCmd(c, "build", contextSymlinkName)

-}

-

-func (s *DockerTrustSuite) TestTrustedBuildTagFromReleasesRole(c *check.C) {

-	testRequires(c, NotaryHosting)

-

-	latestTag := s.setupTrustedImage(c, "trusted-build-releases-role")

-	repoName := strings.TrimSuffix(latestTag, ":latest")

-

-	// Now create the releases role

-	s.notaryCreateDelegation(c, repoName, "targets/releases", s.not.keys[0].Public)

-	s.notaryImportKey(c, repoName, "targets/releases", s.not.keys[0].Private)

-	s.notaryPublish(c, repoName)

-

-	// push a different tag to the releases role

-	otherTag := fmt.Sprintf("%s:other", repoName)

-	cli.DockerCmd(c, "tag", "busybox", otherTag)

-

-	cli.Docker(cli.Args("push", otherTag), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "other", "targets/releases")

-	s.assertTargetNotInRoles(c, repoName, "other", "targets")

-

-	cli.DockerCmd(c, "rmi", otherTag)

-

-	dockerFile := fmt.Sprintf(`

-  FROM %s

-  RUN []

-    `, otherTag)

-	name := "testtrustedbuildreleasesrole"

-	cli.BuildCmd(c, name, trustedCmd, build.WithDockerfile(dockerFile)).Assert(c, icmd.Expected{

-		Out: fmt.Sprintf("FROM %s@sha", repoName),

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedBuildTagIgnoresOtherDelegationRoles(c *check.C) {

-	testRequires(c, NotaryHosting)

-

-	latestTag := s.setupTrustedImage(c, "trusted-build-releases-role")

-	repoName := strings.TrimSuffix(latestTag, ":latest")

-

-	// Now create a non-releases delegation role

-	s.notaryCreateDelegation(c, repoName, "targets/other", s.not.keys[0].Public)

-	s.notaryImportKey(c, repoName, "targets/other", s.not.keys[0].Private)

-	s.notaryPublish(c, repoName)

-

-	// push a different tag to the other role

-	otherTag := fmt.Sprintf("%s:other", repoName)

-	cli.DockerCmd(c, "tag", "busybox", otherTag)

-

-	cli.Docker(cli.Args("push", otherTag), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "other", "targets/other")

-	s.assertTargetNotInRoles(c, repoName, "other", "targets")

-

-	cli.DockerCmd(c, "rmi", otherTag)

-

-	dockerFile := fmt.Sprintf(`

-  FROM %s

-  RUN []

-    `, otherTag)

-

-	name := "testtrustedbuildotherrole"

-	cli.Docker(cli.Build(name), trustedCmd, build.WithDockerfile(dockerFile)).Assert(c, icmd.Expected{

-		ExitCode: 1,

-	})

-}

-

 // Issue #15634: COPY fails when path starts with "null"

 func (s *DockerSuite) TestBuildNullStringInAddCopyVolume(c *check.C) {

 	name := "testbuildnullstringinaddcopyvolume"

@@ -6018,28 +5884,6 @@ func (s *DockerSuite) TestBuildMultiStageNameVariants(c *check.C) {

 	cli.Docker(cli.Args("run", "build1", "cat", "f2")).Assert(c, icmd.Expected{Out: "bar2"})

 }

-func (s *DockerTrustSuite) TestBuildMultiStageTrusted(c *check.C) {

-	img1 := s.setupTrustedImage(c, "trusted-build1")

-	img2 := s.setupTrustedImage(c, "trusted-build2")

-	dockerFile := fmt.Sprintf(`

-	FROM %s AS build-base

-	RUN echo ok > /foo

-	FROM %s

-	COPY --from=build-base foo bar`, img1, img2)

-

-	name := "testcopyfromtrustedbuild"

-

-	r := buildImage(name, trustedBuild, build.WithDockerfile(dockerFile))

-	r.Assert(c, icmd.Expected{

-		Out: fmt.Sprintf("FROM %s@sha", img1[:len(img1)-7]),

-	})

-	r.Assert(c, icmd.Expected{

-		Out: fmt.Sprintf("FROM %s@sha", img2[:len(img2)-7]),

-	})

-

-	dockerCmdWithResult("run", name, "cat", "bar").Assert(c, icmd.Expected{Out: "ok"})

-}

-

 func (s *DockerSuite) TestBuildMultiStageMultipleBuildsWindows(c *check.C) {

 	testRequires(c, DaemonIsWindows)

 	dockerfile := `

@@ -3,7 +3,6 @@ package main

 import (

 	"encoding/json"

 	"fmt"

-	"io/ioutil"

 	"os"

 	"reflect"

 	"strings"

@@ -16,7 +15,6 @@ import (

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/go-connections/nat"

 	"github.com/go-check/check"

-	"github.com/gotestyourself/gotestyourself/icmd"

 )

 // Make sure we can create a simple container with some args

@@ -292,75 +290,6 @@ func (s *DockerSuite) TestCreateByImageID(c *check.C) {

 	}

 }

-func (s *DockerTrustSuite) TestTrustedCreate(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-create")

-

-	// Try create

-	cli.Docker(cli.Args("create", repoName), trustedCmd).Assert(c, SuccessTagging)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try untrusted create to ensure we pushed the tag to the registry

-	cli.Docker(cli.Args("create", "--disable-content-trust=true", repoName)).Assert(c, SuccessDownloadedOnStderr)

-}

-

-func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercliuntrusted/createtest", privateRegistryURL)

-	withTagName := fmt.Sprintf("%s:latest", repoName)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", withTagName)

-	cli.DockerCmd(c, "push", withTagName)

-	cli.DockerCmd(c, "rmi", withTagName)

-

-	// Try trusted create on untrusted tag

-	cli.Docker(cli.Args("create", withTagName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      fmt.Sprintf("does not have trust data for %s", repoName),

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedIsolatedCreate(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-isolated-create")

-

-	// Try create

-	cli.Docker(cli.Args("--config", "/tmp/docker-isolated-create", "create", repoName), trustedCmd).Assert(c, SuccessTagging)

-	defer os.RemoveAll("/tmp/docker-isolated-create")

-

-	cli.DockerCmd(c, "rmi", repoName)

-}

-

-func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclievilcreate/trusted:latest", privateRegistryURL)

-	evilLocalConfigDir, err := ioutil.TempDir("", "evilcreate-local-config-dir")

-	c.Assert(err, check.IsNil)

-

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try create

-	cli.Docker(cli.Args("create", repoName), trustedCmd).Assert(c, SuccessTagging)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Kill the notary server, start a new "evil" one.

-	s.not.Close()

-	s.not, err = newTestNotary(c)

-	c.Assert(err, check.IsNil)

-

-	// In order to make an evil server, lets re-init a client (with a different trust dir) and push new data.

-	// tag an image and upload it to the private registry

-	cli.DockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)

-

-	// Push up to the new server

-	cli.Docker(cli.Args("--config", evilLocalConfigDir, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Now, try creating with the original client from this new trust server. This should fail because the new root is invalid.

-	cli.Docker(cli.Args("create", repoName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "could not rotate trust to a new trusted root",

-	})

-}

-

 func (s *DockerSuite) TestCreateStopSignal(c *check.C) {

 	name := "test_create_stop_signal"

 	dockerCmd(c, "create", "--name", name, "--stop-signal", "9", "busybox")

@@ -16,7 +16,6 @@ import (

 	"github.com/docker/docker/integration-cli/daemon"

 	"github.com/docker/docker/integration-cli/fixtures/plugin"

 	"github.com/go-check/check"

-	"github.com/gotestyourself/gotestyourself/icmd"

 	"golang.org/x/net/context"

 )

@@ -352,51 +351,6 @@ func (s *DockerSuite) TestPluginInspectOnWindows(c *check.C) {

 	c.Assert(err.Error(), checker.Contains, "plugins are not supported on this platform")

 }

-func (s *DockerTrustSuite) TestPluginTrustedInstall(c *check.C) {

-	testRequires(c, DaemonIsLinux, IsAmd64, Network)

-

-	trustedName := s.setupTrustedplugin(c, pNameWithTag, "trusted-plugin-install")

-

-	cli.Docker(cli.Args("plugin", "install", "--grant-all-permissions", trustedName), trustedCmd).Assert(c, icmd.Expected{

-		Out: trustedName,

-	})

-

-	out := cli.DockerCmd(c, "plugin", "ls").Combined()

-	c.Assert(out, checker.Contains, "true")

-

-	out = cli.DockerCmd(c, "plugin", "disable", trustedName).Combined()

-	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

-

-	out = cli.DockerCmd(c, "plugin", "enable", trustedName).Combined()

-	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

-

-	out = cli.DockerCmd(c, "plugin", "rm", "-f", trustedName).Combined()

-	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

-

-	// Try untrusted pull to ensure we pushed the tag to the registry

-	cli.Docker(cli.Args("plugin", "install", "--disable-content-trust=true", "--grant-all-permissions", trustedName), trustedCmd).Assert(c, SuccessDownloaded)

-

-	out = cli.DockerCmd(c, "plugin", "ls").Combined()

-	c.Assert(out, checker.Contains, "true")

-

-}

-

-func (s *DockerTrustSuite) TestPluginUntrustedInstall(c *check.C) {

-	testRequires(c, DaemonIsLinux, IsAmd64, Network)

-

-	pluginName := fmt.Sprintf("%v/dockercliuntrusted/plugintest:latest", privateRegistryURL)

-	// install locally and push to private registry

-	cli.DockerCmd(c, "plugin", "install", "--grant-all-permissions", "--alias", pluginName, pNameWithTag)

-	cli.DockerCmd(c, "plugin", "push", pluginName)

-	cli.DockerCmd(c, "plugin", "rm", "-f", pluginName)

-

-	// Try trusted install on untrusted plugin

-	cli.Docker(cli.Args("plugin", "install", "--grant-all-permissions", pluginName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "Error: remote trust data does not exist",

-	})

-}

-

 func (ps *DockerPluginSuite) TestPluginIDPrefix(c *check.C) {

 	name := "test"

 	client := testEnv.APIClient()

deleted file mode 100644

@@ -1,222 +0,0 @@

-package main

-

-import (

-	"fmt"

-	"io/ioutil"

-

-	"github.com/docker/docker/integration-cli/checker"

-	"github.com/docker/docker/integration-cli/cli"

-	"github.com/docker/docker/integration-cli/cli/build"

-	"github.com/go-check/check"

-	"github.com/gotestyourself/gotestyourself/icmd"

-)

-

-func (s *DockerTrustSuite) TestTrustedPull(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-pull")

-

-	// Try pull

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, SuccessTagging)

-

-	cli.DockerCmd(c, "rmi", repoName)

-	// Try untrusted pull to ensure we pushed the tag to the registry

-	cli.Docker(cli.Args("pull", "--disable-content-trust=true", repoName), trustedCmd).Assert(c, SuccessDownloaded)

-}

-

-func (s *DockerTrustSuite) TestTrustedIsolatedPull(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-isolated-pull")

-

-	// Try pull (run from isolated directory without trust information)

-	cli.Docker(cli.Args("--config", "/tmp/docker-isolated", "pull", repoName), trustedCmd).Assert(c, SuccessTagging)

-

-	cli.DockerCmd(c, "rmi", repoName)

-}

-

-func (s *DockerTrustSuite) TestUntrustedPull(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercliuntrusted/pulltest:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-	cli.DockerCmd(c, "push", repoName)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try trusted pull on untrusted tag

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "Error: remote trust data does not exist",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclievilpull/trusted:latest", privateRegistryURL)

-	evilLocalConfigDir, err := ioutil.TempDir("", "evil-local-config-dir")

-	if err != nil {

-		c.Fatalf("Failed to create local temp dir")

-	}

-

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try pull

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, SuccessTagging)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Kill the notary server, start a new "evil" one.

-	s.not.Close()

-	s.not, err = newTestNotary(c)

-

-	c.Assert(err, check.IsNil, check.Commentf("Restarting notary server failed."))

-

-	// In order to make an evil server, lets re-init a client (with a different trust dir) and push new data.

-	// tag an image and upload it to the private registry

-	cli.DockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)

-

-	// Push up to the new server

-	cli.Docker(cli.Args("--config", evilLocalConfigDir, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Now, try pulling with the original client from this new trust server. This should fail because the new root is invalid.

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "could not rotate trust to a new trusted root",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedOfflinePull(c *check.C) {

-	repoName := s.setupTrustedImage(c, "trusted-offline-pull")

-

-	cli.Docker(cli.Args("pull", repoName), trustedCmdWithServer("https://invalidnotaryserver")).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "error contacting notary server",

-	})

-	// Do valid trusted pull to warm cache

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, SuccessTagging)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try pull again with invalid notary server, should use cache

-	cli.Docker(cli.Args("pull", repoName), trustedCmdWithServer("https://invalidnotaryserver")).Assert(c, SuccessTagging)

-}

-

-func (s *DockerTrustSuite) TestTrustedPullDelete(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercli/%s:latest", privateRegistryURL, "trusted-pull-delete")

-	// tag the image and upload it to the private registry

-	cli.BuildCmd(c, repoName, build.WithDockerfile(`

-                    FROM busybox

-                    CMD echo trustedpulldelete

-                `))

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try pull

-	result := cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Success)

-

-	matches := digestRegex.FindStringSubmatch(result.Combined())

-	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", result.Combined()))

-	pullDigest := matches[1]

-

-	imageID := inspectField(c, repoName, "Id")

-

-	imageByDigest := repoName + "@" + pullDigest

-	byDigestID := inspectField(c, imageByDigest, "Id")

-

-	c.Assert(byDigestID, checker.Equals, imageID)

-

-	// rmi of tag should also remove the digest reference

-	cli.DockerCmd(c, "rmi", repoName)

-

-	_, err := inspectFieldWithError(imageByDigest, "Id")

-	c.Assert(err, checker.NotNil, check.Commentf("digest reference should have been removed"))

-

-	_, err = inspectFieldWithError(imageID, "Id")

-	c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))

-}

-

-func (s *DockerTrustSuite) TestTrustedPullReadsFromReleasesRole(c *check.C) {

-	testRequires(c, NotaryHosting)

-	repoName := fmt.Sprintf("%v/dockerclireleasesdelegationpulling/trusted", privateRegistryURL)

-	targetName := fmt.Sprintf("%s:latest", repoName)

-

-	// Push with targets first, initializing the repo

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "latest", "targets")

-

-	// Try pull, check we retrieve from targets role

-	cli.Docker(cli.Args("-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Err: "retrieving target for targets role",

-	})

-

-	// Now we'll create the releases role, and try pushing and pulling

-	s.notaryCreateDelegation(c, repoName, "targets/releases", s.not.keys[0].Public)

-	s.notaryImportKey(c, repoName, "targets/releases", s.not.keys[0].Private)

-	s.notaryPublish(c, repoName)

-

-	// try a pull, check that we can still pull because we can still read the

-	// old tag in the targets role

-	cli.Docker(cli.Args("-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Err: "retrieving target for targets role",

-	})

-

-	// try a pull -a, check that it succeeds because we can still pull from the

-	// targets role

-	cli.Docker(cli.Args("-D", "pull", "-a", repoName), trustedCmd).Assert(c, icmd.Success)

-

-	// Push, should sign with targets/releases

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "latest", "targets", "targets/releases")

-

-	// Try pull, check we retrieve from targets/releases role

-	cli.Docker(cli.Args("-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Err: "retrieving target for targets/releases role",

-	})

-

-	// Create another delegation that we'll sign with

-	s.notaryCreateDelegation(c, repoName, "targets/other", s.not.keys[1].Public)

-	s.notaryImportKey(c, repoName, "targets/other", s.not.keys[1].Private)

-	s.notaryPublish(c, repoName)

-

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "latest", "targets", "targets/releases", "targets/other")

-

-	// Try pull, check we retrieve from targets/releases role

-	cli.Docker(cli.Args("-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Err: "retrieving target for targets/releases role",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPullIgnoresOtherDelegationRoles(c *check.C) {

-	testRequires(c, NotaryHosting)

-	repoName := fmt.Sprintf("%v/dockerclipullotherdelegation/trusted", privateRegistryURL)

-	targetName := fmt.Sprintf("%s:latest", repoName)

-

-	// We'll create a repo first with a non-release delegation role, so that when we

-	// push we'll sign it into the delegation role

-	s.notaryInitRepo(c, repoName)

-	s.notaryCreateDelegation(c, repoName, "targets/other", s.not.keys[0].Public)

-	s.notaryImportKey(c, repoName, "targets/other", s.not.keys[0].Private)

-	s.notaryPublish(c, repoName)

-

-	// Push should write to the delegation role, not targets

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, icmd.Success)

-	s.assertTargetInRoles(c, repoName, "latest", "targets/other")

-	s.assertTargetNotInRoles(c, repoName, "latest", "targets")

-

-	// Try pull - we should fail, since pull will only pull from the targets/releases

-	// role or the targets role

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-	cli.Docker(cli.Args("-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "No trust data for",

-	})

-

-	// try a pull -a: we should fail since pull will only pull from the targets/releases

-	// role or the targets role

-	cli.Docker(cli.Args("-D", "pull", "-a", repoName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "No trusted tags for",

-	})

-}

@@ -7,14 +7,11 @@ import (

 	"net/http"

 	"net/http/httptest"

 	"os"

-	"path/filepath"

 	"strings"

 	"sync"

 	"github.com/docker/distribution/reference"

-	"github.com/docker/docker/cli/config"

 	"github.com/docker/docker/integration-cli/checker"

-	"github.com/docker/docker/integration-cli/cli"

 	"github.com/docker/docker/integration-cli/cli/build"

 	"github.com/go-check/check"

 	"github.com/gotestyourself/gotestyourself/icmd"

@@ -281,225 +278,6 @@ func (s *DockerSchema1RegistrySuite) TestCrossRepositoryLayerPushNotSupported(c

 	c.Assert(out3, check.Equals, "hello world")

 }

-func (s *DockerTrustSuite) TestTrustedPush(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclitrusted/pushtest:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Try pull after push

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Out: "Status: Image is up to date",

-	})

-

-	// Assert that we rotated the snapshot key to the server by checking our local keystore

-	contents, err := ioutil.ReadDir(filepath.Join(config.Dir(), "trust/private/tuf_keys", privateRegistryURL, "dockerclitrusted/pushtest"))

-	c.Assert(err, check.IsNil, check.Commentf("Unable to read local tuf key files"))

-	// Check that we only have 1 key (targets key)

-	c.Assert(contents, checker.HasLen, 1)

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithEnvPasswords(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclienv/trusted:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	cli.Docker(cli.Args("push", repoName), trustedCmdWithPassphrases("12345678", "12345678")).Assert(c, SuccessSigningAndPushing)

-

-	// Try pull after push

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Out: "Status: Image is up to date",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithFailingServer(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclitrusted/failingserver:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	// Using a name that doesn't resolve to an address makes this test faster

-	cli.Docker(cli.Args("push", repoName), trustedCmdWithServer("https://server.invalid:81/")).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "error contacting notary server",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithoutServerAndUntrusted(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclitrusted/trustedandnot:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	result := cli.Docker(cli.Args("push", "--disable-content-trust", repoName), trustedCmdWithServer("https://server.invalid:81/"))

-	result.Assert(c, icmd.Success)

-	c.Assert(result.Combined(), check.Not(checker.Contains), "Error establishing connection to notary repository", check.Commentf("Missing expected output on trusted push with --disable-content-trust:"))

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithExistingTag(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclitag/trusted:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-	cli.DockerCmd(c, "push", repoName)

-

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Try pull after push

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, icmd.Expected{

-		Out: "Status: Image is up to date",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithExistingSignedTag(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclipushpush/trusted:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	// Do a trusted push

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Do another trusted push

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-	cli.DockerCmd(c, "rmi", repoName)

-

-	// Try pull to ensure the double push did not break our ability to pull

-	cli.Docker(cli.Args("pull", repoName), trustedCmd).Assert(c, SuccessDownloaded)

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithIncorrectPassphraseForNonRoot(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockercliincorretpwd/trusted:latest", privateRegistryURL)

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", repoName)

-

-	// Push with default passphrases

-	cli.Docker(cli.Args("push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// Push with wrong passphrases

-	cli.Docker(cli.Args("push", repoName), trustedCmdWithPassphrases("12345678", "87654321")).Assert(c, icmd.Expected{

-		ExitCode: 1,

-		Err:      "could not find necessary signing keys",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushWithReleasesDelegationOnly(c *check.C) {

-	testRequires(c, NotaryHosting)

-	repoName := fmt.Sprintf("%v/dockerclireleasedelegationinitfirst/trusted", privateRegistryURL)

-	targetName := fmt.Sprintf("%s:latest", repoName)

-	s.notaryInitRepo(c, repoName)

-	s.notaryCreateDelegation(c, repoName, "targets/releases", s.not.keys[0].Public)

-	s.notaryPublish(c, repoName)

-

-	s.notaryImportKey(c, repoName, "targets/releases", s.not.keys[0].Private)

-

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-	// check to make sure that the target has been added to targets/releases and not targets

-	s.assertTargetInRoles(c, repoName, "latest", "targets/releases")

-	s.assertTargetNotInRoles(c, repoName, "latest", "targets")

-

-	// Try pull after push

-	os.RemoveAll(filepath.Join(config.Dir(), "trust"))

-

-	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{

-		Out: "Status: Image is up to date",

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushSignsAllFirstLevelRolesWeHaveKeysFor(c *check.C) {

-	testRequires(c, NotaryHosting)

-	repoName := fmt.Sprintf("%v/dockerclimanyroles/trusted", privateRegistryURL)

-	targetName := fmt.Sprintf("%s:latest", repoName)

-	s.notaryInitRepo(c, repoName)

-	s.notaryCreateDelegation(c, repoName, "targets/role1", s.not.keys[0].Public)

-	s.notaryCreateDelegation(c, repoName, "targets/role2", s.not.keys[1].Public)

-	s.notaryCreateDelegation(c, repoName, "targets/role3", s.not.keys[2].Public)

-

-	// import everything except the third key

-	s.notaryImportKey(c, repoName, "targets/role1", s.not.keys[0].Private)

-	s.notaryImportKey(c, repoName, "targets/role2", s.not.keys[1].Private)

-

-	s.notaryCreateDelegation(c, repoName, "targets/role1/subrole", s.not.keys[3].Public)

-	s.notaryImportKey(c, repoName, "targets/role1/subrole", s.not.keys[3].Private)

-

-	s.notaryPublish(c, repoName)

-

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// check to make sure that the target has been added to targets/role1 and targets/role2, and

-	// not targets (because there are delegations) or targets/role3 (due to missing key) or

-	// targets/role1/subrole (due to it being a second level delegation)

-	s.assertTargetInRoles(c, repoName, "latest", "targets/role1", "targets/role2")

-	s.assertTargetNotInRoles(c, repoName, "latest", "targets")

-

-	// Try pull after push

-	os.RemoveAll(filepath.Join(config.Dir(), "trust"))

-

-	// pull should fail because none of these are the releases role

-	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,

-	})

-}

-

-func (s *DockerTrustSuite) TestTrustedPushSignsForRolesWithKeysAndValidPaths(c *check.C) {

-	repoName := fmt.Sprintf("%v/dockerclirolesbykeysandpaths/trusted", privateRegistryURL)

-	targetName := fmt.Sprintf("%s:latest", repoName)

-	s.notaryInitRepo(c, repoName)

-	s.notaryCreateDelegation(c, repoName, "targets/role1", s.not.keys[0].Public, "l", "z")

-	s.notaryCreateDelegation(c, repoName, "targets/role2", s.not.keys[1].Public, "x", "y")

-	s.notaryCreateDelegation(c, repoName, "targets/role3", s.not.keys[2].Public, "latest")

-	s.notaryCreateDelegation(c, repoName, "targets/role4", s.not.keys[3].Public, "latest")

-

-	// import everything except the third key

-	s.notaryImportKey(c, repoName, "targets/role1", s.not.keys[0].Private)

-	s.notaryImportKey(c, repoName, "targets/role2", s.not.keys[1].Private)

-	s.notaryImportKey(c, repoName, "targets/role4", s.not.keys[3].Private)

-

-	s.notaryPublish(c, repoName)

-

-	// tag the image and upload it to the private registry

-	cli.DockerCmd(c, "tag", "busybox", targetName)

-

-	cli.Docker(cli.Args("push", targetName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-

-	// check to make sure that the target has been added to targets/role1 and targets/role4, and

-	// not targets (because there are delegations) or targets/role2 (due to path restrictions) or

-	// targets/role3 (due to missing key)

-	s.assertTargetInRoles(c, repoName, "latest", "targets/role1", "targets/role4")

-	s.assertTargetNotInRoles(c, repoName, "latest", "targets")

-

-	// Try pull after push

-	os.RemoveAll(filepath.Join(config.Dir(), "trust"))

-

-	// pull should fail because none of these are the releases role

-	cli.Docker(cli.Args("pull", targetName), trustedCmd).Assert(c, icmd.Expected{

-		ExitCode: 1,