@@ -176,7 +176,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0

+ENV NOTARY_VERSION v0.4.2

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -121,7 +121,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0

+ENV NOTARY_VERSION v0.4.2

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -120,7 +120,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0

+ENV NOTARY_VERSION v0.4.2

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -139,7 +139,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0

+ENV NOTARY_VERSION v0.4.2

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -131,7 +131,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0

+ENV NOTARY_VERSION v0.4.2

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -99,7 +99,7 @@ clone git github.com/mistifyio/go-zfs 22c9b32c84eb0d0c6f4043b6e90fc94073de92fa

 clone git github.com/pborman/uuid v1.0

 # get desired notary commit, might also need to be updated in Dockerfile

-clone git github.com/docker/notary v0.3.0

+clone git github.com/docker/notary v0.4.2

 clone git google.golang.org/grpc v1.0.1-GA https://github.com/grpc/grpc-go.git

 clone git github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f

@@ -1,3 +1,4 @@

+/.vscode

 /cmd/notary-server/notary-server

 /cmd/notary-server/local.config.json

 /cmd/notary-signer/local.config.json

@@ -8,4 +9,5 @@ cross

 *.swp

 .idea

 *.iml

+*.test

 coverage.out

@@ -1,5 +1,66 @@

 # Changelog

+## [v0.4.2](https://github.com/docker/notary/releases/tag/v0.4.2) 9/30/2016

++ Bump the cross compiler to golang 1.7.1, since [1.6.3 builds binaries that could have non-deterministic bugs in OS X Sierra](https://groups.google.com/forum/#!msg/golang-dev/Jho5sBHZgAg/cq6d97S1AwAJ) [#984](https://github.com/docker/notary/pull/984)

+

+## [v0.4.1](https://github.com/docker/notary/releases/tag/v0.4.1) 9/27/2016

++ Preliminary Windows support for notary client [#970](https://github.com/docker/notary/pull/970)

++ Output message to CLI when repo changes have been successfully published [#974](https://github.com/docker/notary/pull/974)

++ Improved error messages for client authentication errors and for the witness command [#972](https://github.com/docker/notary/pull/972)

++ Support for finding keys that are anywhere in the notary directory's "private" directory, not just under "private/root_keys" or "private/tuf_keys" [#981](https://github.com/docker/notary/pull/981)

++ Previously, on any error updating, the client would fall back on the cache.  Now we only do so if there is a network error or if the server is unavailable or missing the TUF data. Invalid TUF data will cause the update to fail - for example if there was an invalid root rotation. [#982](https://github.com/docker/notary/pull/982)

+

+## [v0.4.0](https://github.com/docker/notary/releases/tag/v0.4.0) 9/21/2016

++ Server-managed key rotations [#889](https://github.com/docker/notary/pull/889)

++ Remove `timestamp_keys` table, which stored redundant information [#889](https://github.com/docker/notary/pull/889)

++ Introduce `notary delete` command to delete local and/or remote repo data [#895](https://github.com/docker/notary/pull/895)

++ Introduce `notary witness` command to stage signatures for specified roles [#875](https://github.com/docker/notary/pull/875)

++ Add `-p` flag to offline commands to attempt auto-publish [#886](https://github.com/docker/notary/pull/886) [#912](https://github.com/docker/notary/pull/912) [#923](https://github.com/docker/notary/pull/923)

++ Introduce `notary reset` command to manage staged changes [#959](https://github.com/docker/notary/pull/959) [#856](https://github.com/docker/notary/pull/856)

++ Add `--rootkey` flag to `notary init` to provide a private root key for a repo [#801](https://github.com/docker/notary/pull/801)

++ Introduce `notary delegation purge` command to remove a specified key from all delegations [#855](https://github.com/docker/notary/pull/855)

++ Removed HTTP endpoint from notary-signer [#870](https://github.com/docker/notary/pull/870)

++ Refactored and unified key storage [#825](https://github.com/docker/notary/pull/825)

++ Batched key import and export now operate on PEM files (potentially with multiple blocks) instead of ZIP [#825](https://github.com/docker/notary/pull/825) [#882](https://github.com/docker/notary/pull/882)

++ Add full database integration test-suite [#824](https://github.com/docker/notary/pull/824) [#854](https://github.com/docker/notary/pull/854) [#863](https://github.com/docker/notary/pull/863)

++ Improve notary-server, trust pinning, and yubikey logging [#798](https://github.com/docker/notary/pull/798) [#858](https://github.com/docker/notary/pull/858) [#891](https://github.com/docker/notary/pull/891)

++ Warn if certificates for root or delegations are near expiry [#802](https://github.com/docker/notary/pull/802)

++ Warn if role metadata is near expiry [#786](https://github.com/docker/notary/pull/786)

++ Reformat CLI table output to use the `text/tabwriter` package [#809](https://github.com/docker/notary/pull/809)

++ Fix passphrase retrieval attempt counting and terminal detection [#906](https://github.com/docker/notary/pull/906)

++ Fix listing nested delegations [#864](https://github.com/docker/notary/pull/864)

++ Bump go version to 1.6.3, fix go1.7 compatibility [#851](https://github.com/docker/notary/pull/851) [#793](https://github.com/docker/notary/pull/793)

++ Convert docker-compose files to v2 format [#755](https://github.com/docker/notary/pull/755)

++ Validate root rotations against trust pinning [#800](https://github.com/docker/notary/pull/800)

++ Update fixture certificates for two-year expiry window [#951](https://github.com/docker/notary/pull/951)

+

+## [v0.3.0](https://github.com/docker/notary/releases/tag/v0.3.0) 5/11/2016

++ Root rotations

++ RethinkDB support as a storage backend for Server and Signer

++ A new TUF repo builder that merges server and client validation

++ Trust Pinning: configure known good key IDs and CAs to replace TOFU.

++ Add --input, --output, and --quiet flags to notary verify command

++ Remove local certificate store. It was redundant as all certs were also stored in the cached root.json

++ Cleanup of dead code in client side key storage logic

++ Update project to Go 1.6.1

++ Reorganize vendoring to meet Go 1.6+ standard. Still using Godeps to manage vendored packages

++ Add targets by hash, no longer necessary to have the original target data available

++ Active Key ID verification during signature verification

++ Switch all testing from assert to require, reduces noise in test runs

++ Use alpine based images for smaller downloads and faster setup times

++ Clean up out of data signatures when re-signing content

++ Set cache control headers on HTTP responses from Notary Server

++ Add sha512 support for targets

++ Add environment variable for delegation key passphrase

++ Reduce permissions requested by client from token server

++ Update formatting for delegation list output

++ Move SQLite dependency to tests only so it doesn't get built into official images

++ Fixed asking for password to list private repositories

++ Enable using notary client with username/password in a scripted fashion

++ Fix static compilation of client

++ Enforce TUF version to be >= 1, previously 0 was acceptable although unused

++ json.RawMessage should always be used as *json.RawMessage due to concepts of addressability in Go and effects on encoding

+

 ## [v0.2](https://github.com/docker/notary/releases/tag/v0.2.0) 2/24/2016

 + Add support for delegation roles in `notary` server and client

 + Add `notary CLI` commands for managing delegation roles: `notary delegation`

@@ -1,4 +1,4 @@

-FROM golang:1.6.1

+FROM golang:1.7.1

 RUN apt-get update && apt-get install -y \

 	curl \

@@ -8,10 +8,14 @@ RUN apt-get update && apt-get install -y \

 	patch \

 	tar \

 	xz-utils \

+	python \

+	python-pip \

 	--no-install-recommends \

 	&& rm -rf /var/lib/apt/lists/*

-RUN go get golang.org/x/tools/cmd/cover

+RUN useradd -ms /bin/bash notary \

+	&& pip install codecov \

+	&& go get golang.org/x/tools/cmd/cover github.com/golang/lint/golint github.com/client9/misspell/cmd/misspell github.com/gordonklaus/ineffassign

 # Configure the container for OSX cross compilation

 ENV OSX_SDK MacOSX10.11.sdk

@@ -27,8 +31,7 @@ ENV PATH /osxcross/target/bin:$PATH

 ENV NOTARYDIR /go/src/github.com/docker/notary

 COPY . ${NOTARYDIR}

-

-ENV GOPATH ${NOTARYDIR}/Godeps/_workspace:$GOPATH

+RUN chmod -R a+rw /go

 WORKDIR ${NOTARYDIR}

@@ -13,13 +13,15 @@ endif

 CTIMEVAR=-X $(NOTARY_PKG)/version.GitCommit=$(GITCOMMIT) -X $(NOTARY_PKG)/version.NotaryVersion=$(NOTARY_VERSION)

 GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"

 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"

-GOOSES = darwin linux

+GOOSES = darwin linux windows

 NOTARY_BUILDTAGS ?= pkcs11

 NOTARYDIR := /go/src/github.com/docker/notary

-GO_VERSION := $(shell go version | grep "1\.[6-9]\(\.[0-9]+\)*")

-# check to make sure we have the right version

-ifeq ($(strip $(GO_VERSION)),)

+GO_VERSION := $(shell go version | grep "1\.[6-9]\(\.[0-9]+\)*\|devel")

+# check to make sure we have the right version. development versions of Go are

+# not officially supported, but allowed for building

+

+ifeq ($(strip $(GO_VERSION))$(SKIPENVCHECK),)

 $(error Bad Go version - please install Go >= 1.6)

 endif

@@ -40,13 +42,11 @@ COVERPROFILE?=$(COVERDIR)/cover.out

 COVERMODE=count

 PKGS ?= $(shell go list -tags "${NOTARY_BUILDTAGS}" ./... | grep -v /vendor/ | tr '\n' ' ')

-GO_VERSION = $(shell go version | awk '{print $$3}')

-

-.PHONY: clean all fmt vet lint build test binaries cross cover docker-images notary-dockerfile

+.PHONY: clean all lint build test binaries cross cover docker-images notary-dockerfile

 .DELETE_ON_ERROR: cover

 .DEFAULT: default

-all: AUTHORS clean fmt vet fmt lint build test binaries

+all: AUTHORS clean lint build test binaries

 AUTHORS: .git/HEAD

 	git log --format='%aN <%aE>' | sort -fu > $@

@@ -90,32 +90,27 @@ ${PREFIX}/bin/static/notary:

 	@go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS_STATIC} ./cmd/notary

 endif

-vet:

-	@echo "+ $@"

+

+# run all lint functionality - excludes Godep directory, vendoring, binaries, python tests, and git files

+lint:

+	@echo "+ $@: golint, go vet, go fmt, misspell, ineffassign"

+	# golint

+	@test -z "$(shell find . -type f -name "*.go" -not -path "./vendor/*" -not -name "*.pb.*" -exec golint {} \; | tee /dev/stderr)"

+	# gofmt

+	@test -z "$$(gofmt -s -l .| grep -v .pb. | grep -v vendor/ | tee /dev/stderr)"

+	# govet

 ifeq ($(shell uname -s), Darwin)

 	@test -z "$(shell find . -iname *test*.go | grep -v _test.go | grep -v vendor | xargs echo "This file should end with '_test':"  | tee /dev/stderr)"

 else

 	@test -z "$(shell find . -iname *test*.go | grep -v _test.go | grep -v vendor | xargs -r echo "This file should end with '_test':"  | tee /dev/stderr)"

 endif

 	@test -z "$$(go tool vet -printf=false . 2>&1 | grep -v vendor/ | tee /dev/stderr)"

-

-fmt:

-	@echo "+ $@"

-	@test -z "$$(gofmt -s -l .| grep -v .pb. | grep -v vendor/ | tee /dev/stderr)"

-

-lint:

-	@echo "+ $@"

-	@test -z "$(shell find . -type f -name "*.go" -not -path "./vendor/*" -not -name "*.pb.*" -exec golint {} \; | tee /dev/stderr)"

-

-# Requires that the following:

-# go get -u github.com/client9/misspell/cmd/misspell

-#

-# be run first

-

-# misspell target, don't include Godeps, binaries, python tests, or git files

-misspell:

-	@echo "+ $@"

-	@test -z "$$(find . -name '*' | grep -v vendor/ | grep -v bin/ | grep -v misc/ | grep -v .git/ | xargs misspell | tee /dev/stderr)"

+	# misspell - requires that the following be run first:

+	#    go get -u github.com/client9/misspell/cmd/misspell

+	@test -z "$$(find . -type f | grep -v vendor/ | grep -v bin/ | grep -v misc/ | grep -v .git/ | grep -v \.pdf | xargs misspell | tee /dev/stderr)"

+	# ineffassign - requires that the following be run first:

+	#    go get -u github.com/gordonklaus/ineffassign

+	@test -z "$(shell find . -type f -name "*.go" -not -path "./vendor/*" -not -name "*.pb.*" -exec ineffassign {} \; | tee /dev/stderr)"

 build:

 	@echo "+ $@"

@@ -130,15 +125,13 @@ test:

 	@echo

 	go test -tags "${NOTARY_BUILDTAGS}" $(TESTOPTS) $(PKGS)

-test-full: TESTOPTS =

-test-full: vet lint

-	@echo Note: when testing with a yubikey plugged in, make sure to include 'TESTOPTS="-p 1"'

-	@echo "+ $@"

-	@echo

-	go test -tags "${NOTARY_BUILDTAGS}" $(TESTOPTS) -v $(PKGS)

+integration: TESTDB = mysql

+integration: clean

+	buildscripts/integrationtest.sh $(TESTDB)

-integration:

-	buildscripts/integrationtest.sh development.yml

+testdb: TESTDB = mysql

+testdb:

+	buildscripts/dbtests.sh $(TESTDB)

 protos:

 	@protoc --go_out=plugins=grpc:. proto/*.proto

@@ -148,25 +141,19 @@ protos:

 # go get github.com/wadey/gocovmerge; go install github.com/wadey/gocovmerge

 #

 # be run first

-

-define gocover

-go test $(OPTS) $(TESTOPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).$(subst $(_space),.,$(NOTARY_BUILDTAGS)).coverage.txt" "$(1)" || exit 1;

-endef

-

+gen-cover:

 gen-cover:

 	@mkdir -p "$(COVERDIR)"

-	$(foreach PKG,$(PKGS),$(call gocover,$(PKG)))

-	rm -f "$(COVERDIR)"/*testutils*.coverage.txt

+	python -u buildscripts/covertest.py --coverdir "$(COVERDIR)" --tags "$(NOTARY_BUILDTAGS)" --pkgs="$(PKGS)" --testopts="${TESTOPTS}"

 # Generates the cover binaries and runs them all in serial, so this can be used

 # run all tests with a yubikey without any problems

-cover: OPTS = -tags "${NOTARY_BUILDTAGS}" -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"

 cover: gen-cover covmerge

 	@go tool cover -html="$(COVERPROFILE)"

 # Generates the cover binaries and runs them all in serial, so this can be used

 # run all tests with a yubikey without any problems

-ci: OPTS = -tags "${NOTARY_BUILDTAGS}" -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"

+ci: override TESTOPTS = -race

 # Codecov knows how to merge multiple coverage files, so covmerge is not needed

 ci: gen-cover

@@ -205,10 +192,9 @@ shell: notary-dockerfile

 cross: notary-dockerfile

 	@rm -rf $(CURDIR)/cross

-	docker run --rm -v $(CURDIR)/cross:$(NOTARYDIR)/cross -e NOTARY_BUILDTAGS=$(NOTARY_BUILDTAGS) notary buildscripts/cross.sh $(GOOSES)

-

+	docker run --rm -v $(CURDIR)/cross:$(NOTARYDIR)/cross -e CTIMEVAR="${CTIMEVAR}" -e NOTARY_BUILDTAGS=$(NOTARY_BUILDTAGS) notary buildscripts/cross.sh $(GOOSES)

 clean:

 	@echo "+ $@"

-	@rm -rf "$(COVERDIR)"

+	@rm -rf "$(COVERDIR)" cross

 	@rm -rf "${PREFIX}/bin/notary-server" "${PREFIX}/bin/notary" "${PREFIX}/bin/notary-signer"

@@ -1 +1 @@

-0.2

+0.4.2

@@ -1,5 +1,5 @@

 # Notary

-[![Circle CI](https://circleci.com/gh/docker/notary/tree/master.svg?style=shield)](https://circleci.com/gh/docker/notary/tree/master) [![CodeCov](https://codecov.io/github/docker/notary/coverage.svg?branch=master)](https://codecov.io/github/docker/notary)

+[![Circle CI](https://circleci.com/gh/docker/notary/tree/master.svg?style=shield)](https://circleci.com/gh/docker/notary/tree/master) [![CodeCov](https://codecov.io/github/docker/notary/coverage.svg?branch=master)](https://codecov.io/github/docker/notary) [![GoReportCard](https://goreportcard.com/badge/docker/notary)](https://goreportcard.com/report/github.com/docker/notary)

 The Notary project comprises a [server](cmd/notary-server) and a [client](cmd/notary) for running and interacting

 with trusted collections.  Please see the [service architecture](docs/service_architecture.md) documentation

@@ -80,7 +80,8 @@ to use `notary` with Docker images.

 Prerequisites:

-- Go >= 1.6.1

+- Go >= 1.7

+

 - [godep](https://github.com/tools/godep) installed

 - libtool development headers installed

     - Ubuntu: `apt-get install libltdl-dev`

@@ -1,87 +1,23 @@

-# Pony-up!

 machine:

   pre:

-  # Install gvm

-    - bash < <(curl -s -S -L https://raw.githubusercontent.com/moovweb/gvm/1.0.22/binscripts/gvm-installer)

   # Upgrade docker

-    - sudo curl -L -o /usr/bin/docker 'https://s3-external-1.amazonaws.com/circle-downloads/docker-1.9.1-circleci'

-    - sudo chmod 0755 /usr/bin/docker

-

-  post:

-  # Install many go versions

-    - gvm install go1.6.1 -B --name=stable

+    - curl -sSL https://s3.amazonaws.com/circle-downloads/install-circleci-docker.sh | bash -s -- 1.10.0

   # upgrade compose

     - sudo pip install --upgrade docker-compose

   services:

     - docker

-  environment:

-  # Convenient shortcuts to "common" locations

-    CHECKOUT: /home/ubuntu/$CIRCLE_PROJECT_REPONAME

-    BASE_DIR: src/github.com/docker/notary

-  # Trick circle brainflat "no absolute path" behavior

-    BASE_STABLE: ../../../$HOME/.gvm/pkgsets/stable/global/$BASE_DIR

-  # Workaround Circle parsing dumb bugs and/or YAML wonkyness

-    CIRCLE_PAIN: "mode: set"

-  # Put the coverage profile somewhere codecov's script can find it

-    COVERPROFILE: coverage.out

-

-  hosts:

-  # Not used yet

-    fancy: 127.0.0.1

-

 dependencies:

-  pre:

-  # Copy the code to the gopath of all go versions

-    - >

-      gvm use stable &&

-      mkdir -p "$(dirname $BASE_STABLE)" &&

-      cp -R "$CHECKOUT" "$BASE_STABLE"

-

   override:

-   # don't use circleci's default dependency installation step of `go get -d -u ./...`

-   # since we already vendor everything; additionally install linting and misspell tools

-    - >

-      gvm use stable &&

-      go get github.com/golang/lint/golint &&

-      go get -u github.com/client9/misspell/cmd/misspell

+    - docker build -t notary_client .

 test:

-  pre:

-  # Output the go versions we are going to test

-    - gvm use stable && go version

-

-  # CLEAN

-    - gvm use stable && make clean:

-        pwd: $BASE_STABLE

-

-  # FMT

-    - gvm use stable && make fmt:

-        pwd: $BASE_STABLE

-

-  # VET

-    - gvm use stable && make vet:

-        pwd: $BASE_STABLE

-

-  # LINT

-    - gvm use stable && make lint:

-        pwd: $BASE_STABLE

-

-  # MISSPELL

-    - gvm use stable && make misspell:

-        pwd: $BASE_STABLE

-

   override:

-  # Test stable, and report

-  # hacking this to be parallel

-    - case $CIRCLE_NODE_INDEX in 0) gvm use stable && NOTARY_BUILDTAGS=pkcs11 make ci ;; 1) gvm use stable && NOTARY_BUILDTAGS=none make ci ;; 2) gvm use stable && make integration ;; esac:

+  # circleci only supports manual parellism

+    - buildscripts/circle_parallelism.sh:

         parallel: true

         timeout: 600

-        pwd: $BASE_STABLE

-

   post:

-  # Report to codecov.io

-    - case $CIRCLE_NODE_INDEX in 0) bash <(curl -s https://codecov.io/bash) ;; 1) bash <(curl -s https://codecov.io/bash) ;; esac:

-        parallel: true

-        pwd: $BASE_STABLE

+    - docker-compose -f docker-compose.yml down -v

+    - docker-compose -f docker-compose.rethink.yml down -v

@@ -4,7 +4,7 @@ import (

 	"github.com/docker/notary/tuf/data"

 )

-// Scopes for TufChanges are simply the TUF roles.

+// Scopes for TUFChanges are simply the TUF roles.

 // Unfortunately because of targets delegations, we can only

 // cover the base roles.

 const (

@@ -14,7 +14,7 @@ const (

 	ScopeTimestamp = "timestamp"

 )

-// Types for TufChanges are namespaced by the Role they

+// Types for TUFChanges are namespaced by the Role they

 // are relevant for. The Root and Targets roles are the

 // only ones for which user action can cause a change, as

 // all changes in Snapshot and Timestamp are programmatically

@@ -23,10 +23,11 @@ const (

 	TypeRootRole          = "role"

 	TypeTargetsTarget     = "target"

 	TypeTargetsDelegation = "delegation"

+	TypeWitness           = "witness"

 )

-// TufChange represents a change to a TUF repo

-type TufChange struct {

+// TUFChange represents a change to a TUF repo

+type TUFChange struct {

 	// Abbreviated because Go doesn't permit a field and method of the same name

 	Actn       string `json:"action"`

 	Role       string `json:"role"`

@@ -35,16 +36,16 @@ type TufChange struct {

 	Data       []byte `json:"data"`

 }

-// TufRootData represents a modification of the keys associated

+// TUFRootData represents a modification of the keys associated

 // with a role that appears in the root.json

-type TufRootData struct {

+type TUFRootData struct {

 	Keys     data.KeyList `json:"keys"`

 	RoleName string       `json:"role"`

 }

-// NewTufChange initializes a tufChange object

-func NewTufChange(action string, role, changeType, changePath string, content []byte) *TufChange {

-	return &TufChange{

+// NewTUFChange initializes a TUFChange object

+func NewTUFChange(action string, role, changeType, changePath string, content []byte) *TUFChange {

+	return &TUFChange{

 		Actn:       action,

 		Role:       role,

 		ChangeType: changeType,

@@ -54,34 +55,34 @@ func NewTufChange(action string, role, changeType, changePath string, content []

 }

 // Action return c.Actn

-func (c TufChange) Action() string {

+func (c TUFChange) Action() string {

 	return c.Actn

 }

 // Scope returns c.Role

-func (c TufChange) Scope() string {

+func (c TUFChange) Scope() string {

 	return c.Role

 }

 // Type returns c.ChangeType

-func (c TufChange) Type() string {

+func (c TUFChange) Type() string {

 	return c.ChangeType

 }

 // Path return c.ChangePath

-func (c TufChange) Path() string {

+func (c TUFChange) Path() string {

 	return c.ChangePath

 }

 // Content returns c.Data

-func (c TufChange) Content() []byte {

+func (c TUFChange) Content() []byte {

 	return c.Data

 }

-// TufDelegation represents a modification to a target delegation

+// TUFDelegation represents a modification to a target delegation

 // this includes creating a delegations. This format is used to avoid

 // unexpected race conditions between humans modifying the same delegation

-type TufDelegation struct {

+type TUFDelegation struct {

 	NewName       string       `json:"new_name,omitempty"`

 	NewThreshold  int          `json:"threshold, omitempty"`

 	AddKeys       data.KeyList `json:"add_keys, omitempty"`

@@ -91,8 +92,8 @@ type TufDelegation struct {

 	ClearAllPaths bool         `json:"clear_paths,omitempty"`

 }

-// ToNewRole creates a fresh role object from the TufDelegation data

-func (td TufDelegation) ToNewRole(scope string) (*data.Role, error) {

+// ToNewRole creates a fresh role object from the TUFDelegation data

+func (td TUFDelegation) ToNewRole(scope string) (*data.Role, error) {

 	name := scope

 	if td.NewName != "" {

 		name = td.NewName

@@ -21,6 +21,24 @@ func (cl *memChangelist) Add(c Change) error {

 	return nil

 }

+// Remove deletes the changes found at the given indices

+func (cl *memChangelist) Remove(idxs []int) error {

+	remove := make(map[int]struct{})

+	for _, i := range idxs {

+		remove[i] = struct{}{}

+	}

+	var keep []Change

+

+	for i, c := range cl.changes {

+		if _, ok := remove[i]; ok {

+			continue

+		}

+		keep = append(keep, c)

+	}

+	cl.changes = keep

+	return nil

+}

+

 // Clear empties the changelist file.

 func (cl *memChangelist) Clear(archive string) error {

 	// appending to a nil list initializes it.

@@ -5,12 +5,12 @@ import (

 	"fmt"

 	"io/ioutil"

 	"os"

-	"path"

 	"sort"

 	"time"

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution/uuid"

+	"path/filepath"

 )

 // FileChangelist stores all the changes as files

@@ -46,13 +46,14 @@ func getFileNames(dirName string) ([]os.FileInfo, error) {

 		}

 		fileInfos = append(fileInfos, f)

 	}

+	sort.Sort(fileChanges(fileInfos))

 	return fileInfos, nil

 }

-// Read a JSON formatted file from disk; convert to TufChange struct

-func unmarshalFile(dirname string, f os.FileInfo) (*TufChange, error) {

-	c := &TufChange{}

-	raw, err := ioutil.ReadFile(path.Join(dirname, f.Name()))

+// Read a JSON formatted file from disk; convert to TUFChange struct

+func unmarshalFile(dirname string, f os.FileInfo) (*TUFChange, error) {

+	c := &TUFChange{}

+	raw, err := ioutil.ReadFile(filepath.Join(dirname, f.Name()))

 	if err != nil {

 		return c, err

 	}

@@ -70,7 +71,6 @@ func (cl FileChangelist) List() []Change {

 	if err != nil {

 		return changes

 	}

-	sort.Sort(fileChanges(fileInfos))

 	for _, f := range fileInfos {

 		c, err := unmarshalFile(cl.dir, f)

 		if err != nil {

@@ -89,10 +89,32 @@ func (cl FileChangelist) Add(c Change) error {

 		return err

 	}

 	filename := fmt.Sprintf("%020d_%s.change", time.Now().UnixNano(), uuid.Generate())

-	return ioutil.WriteFile(path.Join(cl.dir, filename), cJSON, 0644)

+	return ioutil.WriteFile(filepath.Join(cl.dir, filename), cJSON, 0644)

+}

+

+// Remove deletes the changes found at the given indices

+func (cl FileChangelist) Remove(idxs []int) error {

+	fileInfos, err := getFileNames(cl.dir)

+	if err != nil {

+		return err

+	}

+	remove := make(map[int]struct{})

+	for _, i := range idxs {

+		remove[i] = struct{}{}

+	}

+	for i, c := range fileInfos {

+		if _, ok := remove[i]; ok {

+			file := filepath.Join(cl.dir, c.Name())

+			if err := os.Remove(file); err != nil {

+				logrus.Errorf("could not remove change %d: %s", i, err.Error())

+			}

+		}

+	}

+	return nil

 }

 // Clear clears the change list

+// N.B. archiving not currently implemented

 func (cl FileChangelist) Clear(archive string) error {

 	dir, err := os.Open(cl.dir)

 	if err != nil {

@@ -104,7 +126,7 @@ func (cl FileChangelist) Clear(archive string) error {

 		return err

 	}

 	for _, f := range files {

-		os.Remove(path.Join(cl.dir, f.Name()))

+		os.Remove(filepath.Join(cl.dir, f.Name()))

 	}

 	return nil

 }

@@ -121,7 +143,6 @@ func (cl FileChangelist) NewIterator() (ChangeIterator, error) {

 	if err != nil {

 		return &FileChangeListIterator{}, err

 	}

-	sort.Sort(fileChanges(fileInfos))

 	return &FileChangeListIterator{dirname: cl.dir, collection: fileInfos}, nil

 }

@@ -15,6 +15,9 @@ type Changelist interface {

 	// to save a copy of the changelist in that location

 	Clear(archive string) error

+	// Remove deletes the changes corresponding with the indices given

+	Remove(idxs []int) error

+

 	// Close syncronizes any pending writes to the underlying

 	// storage and closes the file/connection

 	Close() error

@@ -16,13 +16,12 @@ import (

 	"github.com/docker/notary"

 	"github.com/docker/notary/client/changelist"

 	"github.com/docker/notary/cryptoservice"

+	store "github.com/docker/notary/storage"

 	"github.com/docker/notary/trustmanager"

 	"github.com/docker/notary/trustpinning"

 	"github.com/docker/notary/tuf"

-	tufclient "github.com/docker/notary/tuf/client"

 	"github.com/docker/notary/tuf/data"

 	"github.com/docker/notary/tuf/signed"

-	"github.com/docker/notary/tuf/store"

 	"github.com/docker/notary/tuf/utils"

 )

@@ -85,6 +84,7 @@ type NotaryRepository struct {

 	fileStore     store.MetadataStore

 	CryptoService signed.CryptoService

 	tufRepo       *tuf.Repo

+	invalid       *tuf.Repo // known data that was parsable but deemed invalid

 	roundTrip     http.RoundTripper

 	trustPinning  trustpinning.TrustPinConfig

 }

@@ -121,7 +121,7 @@ func repositoryFromKeystores(baseDir, gun, baseURL string, rt http.RoundTripper,

 }

 // Target represents a simplified version of the data TUF operates on, so external

-// applications don't have to depend on tuf data types.

+// applications don't have to depend on TUF data types.

 type Target struct {

 	Name   string      // the name of the target

 	Hashes data.Hashes // the hash of the target

@@ -159,7 +159,7 @@ func rootCertKey(gun string, privKey data.PrivateKey) (data.PublicKey, error) {

 		return nil, err

 	}

-	x509PublicKey := trustmanager.CertToKey(cert)

+	x509PublicKey := utils.CertToKey(cert)

 	if x509PublicKey == nil {

 		return nil, fmt.Errorf(

 			"cannot use regenerated certificate: format %s", cert.PublicKeyAlgorithm)

@@ -173,10 +173,14 @@ func rootCertKey(gun string, privKey data.PrivateKey) (data.PublicKey, error) {

 // timestamp key and possibly other serverManagedRoles), but the created repository

 // result is only stored on local disk, not published to the server. To do that,

 // use r.Publish() eventually.

-func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...string) error {

-	privKey, _, err := r.CryptoService.GetPrivateKey(rootKeyID)

-	if err != nil {

-		return err

+func (r *NotaryRepository) Initialize(rootKeyIDs []string, serverManagedRoles ...string) error {

+	privKeys := make([]data.PrivateKey, 0, len(rootKeyIDs))

+	for _, keyID := range rootKeyIDs {

+		privKey, _, err := r.CryptoService.GetPrivateKey(keyID)

+		if err != nil {

+			return err

+		}

+		privKeys = append(privKeys, privKey)

 	}

 	// currently we only support server managing timestamps and snapshots, and

@@ -206,16 +210,20 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 		}

 	}

-	rootKey, err := rootCertKey(r.gun, privKey)

-	if err != nil {

-		return err

+	rootKeys := make([]data.PublicKey, 0, len(privKeys))

+	for _, privKey := range privKeys {

+		rootKey, err := rootCertKey(r.gun, privKey)

+		if err != nil {

+			return err

+		}

+		rootKeys = append(rootKeys, rootKey)

 	}

 	var (

 		rootRole = data.NewBaseRole(

 			data.CanonicalRootRole,

 			notary.MinThreshold,

-			rootKey,

+			rootKeys...,

 		)

 		timestampRole data.BaseRole

 		snapshotRole  data.BaseRole

@@ -271,7 +279,7 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 	r.tufRepo = tuf.NewRepo(r.CryptoService)

-	err = r.tufRepo.InitRoot(

+	err := r.tufRepo.InitRoot(

 		rootRole,

 		timestampRole,

 		snapshotRole,

@@ -307,14 +315,14 @@ func addChange(cl *changelist.FileChangelist, c changelist.Change, roles ...stri

 	for _, role := range roles {

 		// Ensure we can only add targets to the CanonicalTargetsRole,

 		// or a Delegation role (which is <CanonicalTargetsRole>/something else)

-		if role != data.CanonicalTargetsRole && !data.IsDelegation(role) {

+		if role != data.CanonicalTargetsRole && !data.IsDelegation(role) && !data.IsWildDelegation(role) {

 			return data.ErrInvalidRole{

 				Role:   role,

 				Reason: "cannot add targets to this role",

 			}

 		}

-		changes = append(changes, changelist.NewTufChange(

+		changes = append(changes, changelist.NewTUFChange(

 			c.Action(),

 			role,

 			c.Type(),

@@ -352,7 +360,7 @@ func (r *NotaryRepository) AddTarget(target *Target, roles ...string) error {

 		return err

 	}

-	template := changelist.NewTufChange(

+	template := changelist.NewTUFChange(

 		changelist.ActionCreate, "", changelist.TypeTargetsTarget,

 		target.Name, metaJSON)

 	return addChange(cl, template, roles...)

@@ -368,13 +376,14 @@ func (r *NotaryRepository) RemoveTarget(targetName string, roles ...string) erro

 		return err

 	}

 	logrus.Debugf("Removing target \"%s\"", targetName)

-	template := changelist.NewTufChange(changelist.ActionDelete, "",

+	template := changelist.NewTUFChange(changelist.ActionDelete, "",

 		changelist.TypeTargetsTarget, targetName, nil)

 	return addChange(cl, template, roles...)

 }

 // ListTargets lists all targets for the current repository. The list of

 // roles should be passed in order from highest to lowest priority.

+//

 // IMPORTANT: if you pass a set of roles such as [ "targets/a", "targets/x"

 // "targets/a/b" ], even though "targets/a/b" is part of the "targets/a" subtree

 // its entries will be strictly shadowed by those in other parts of the "targets/a"

@@ -402,11 +411,18 @@ func (r *NotaryRepository) ListTargets(roles ...string) ([]*TargetWithRole, erro

 				if _, ok := targets[targetName]; ok || !validRole.CheckPaths(targetName) {

 					continue

 				}

-				targets[targetName] =

-					&TargetWithRole{Target: Target{Name: targetName, Hashes: targetMeta.Hashes, Length: targetMeta.Length}, Role: validRole.Name}

+				targets[targetName] = &TargetWithRole{

+					Target: Target{

+						Name:   targetName,

+						Hashes: targetMeta.Hashes,

+						Length: targetMeta.Length,

+					},

+					Role: validRole.Name,

+				}

 			}

 			return nil

 		}

+

 		r.tufRepo.WalkTargets("", role, listVisitorFunc, skipRoles...)

 	}

@@ -462,6 +478,62 @@ func (r *NotaryRepository) GetTargetByName(name string, roles ...string) (*Targe

 }

+// TargetSignedStruct is a struct that contains a Target, the role it was found in, and the list of signatures for that role

+type TargetSignedStruct struct {

+	Role       data.DelegationRole

+	Target     Target

+	Signatures []data.Signature

+}

+

+// GetAllTargetMetadataByName searches the entire delegation role tree to find the specified target by name for all

+// roles, and returns a list of TargetSignedStructs for each time it finds the specified target.

+// If given an empty string for a target name, it will return back all targets signed into the repository in every role

+func (r *NotaryRepository) GetAllTargetMetadataByName(name string) ([]TargetSignedStruct, error) {

+	if err := r.Update(false); err != nil {

+		return nil, err

+	}

+

+	var targetInfoList []TargetSignedStruct

+

+	// Define a visitor function to find the specified target

+	getAllTargetInfoByNameVisitorFunc := func(tgt *data.SignedTargets, validRole data.DelegationRole) interface{} {

+		if tgt == nil {

+			return nil