@@ -186,7 +186,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0-RC1

+ENV NOTARY_VERSION v0.3.0

 RUN set -x \

 	&& export GO15VENDOREXPERIMENT=1 \

 	&& export GOPATH="$(mktemp -d)" \

@@ -117,7 +117,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0-RC1

+ENV NOTARY_VERSION v0.3.0

 RUN set -x \

 	&& export GO15VENDOREXPERIMENT=1 \

 	&& export GOPATH="$(mktemp -d)" \

@@ -128,7 +128,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0-RC1

+ENV NOTARY_VERSION v0.3.0

 RUN set -x \

 	&& export GO15VENDOREXPERIMENT=1 \

 	&& export GOPATH="$(mktemp -d)" \

@@ -141,7 +141,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0-RC1

+ENV NOTARY_VERSION v0.3.0

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -130,7 +130,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary and notary-server

-ENV NOTARY_VERSION v0.3.0-RC1

+ENV NOTARY_VERSION v0.3.0

 RUN set -x \

 	&& export GO15VENDOREXPERIMENT=1 \

 	&& export GOPATH="$(mktemp -d)" \

@@ -86,7 +86,7 @@ the tagged image prior to the loss. Image consumers would get an error for

 content that they already downloaded:

 ```

-could not validate the path to a trusted root: failed to validate data with current trusted certificates

+Warning: potential malicious behavior - trust data has insufficient signatures for remote repository docker.io/my/image: valid signatures did not meet threshold

 ```

 To correct this, they need to download a new image tag with that is signed with

@@ -56,7 +56,7 @@ clone git github.com/mistifyio/go-zfs 22c9b32c84eb0d0c6f4043b6e90fc94073de92fa

 clone git github.com/pborman/uuid v1.0

 # get desired notary commit, might also need to be updated in Dockerfile

-clone git github.com/docker/notary v0.3.0-RC1

+clone git github.com/docker/notary v0.3.0

 clone git google.golang.org/grpc a22b6611561e9f0a3e0919690dd2caf48f14c517 https://github.com/grpc/grpc-go.git

 clone git github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f

@@ -73,6 +73,9 @@ ${PREFIX}/bin/static/notary-server:

 ${PREFIX}/bin/static/notary-signer:

 	@echo "notary-signer: static builds not supported on OS X"

+

+${PREFIX}/bin/static/notary:

+	@echo "notary: static builds not supported on OS X"

 else

 ${PREFIX}/bin/static/notary-server: NOTARY_VERSION $(shell find . -type f -name '*.go')

 	@echo "+ $@"

@@ -81,6 +84,10 @@ ${PREFIX}/bin/static/notary-server: NOTARY_VERSION $(shell find . -type f -name

 ${PREFIX}/bin/static/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')

 	@echo "+ $@"

 	@go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS_STATIC} ./cmd/notary-signer

+

+${PREFIX}/bin/static/notary:

+	@echo "+ $@"

+	@go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS_STATIC} ./cmd/notary

 endif

 vet:

@@ -179,7 +186,7 @@ client: ${PREFIX}/bin/notary

 binaries: ${PREFIX}/bin/notary-server ${PREFIX}/bin/notary ${PREFIX}/bin/notary-signer

 	@echo "+ $@"

-static: ${PREFIX}/bin/static/notary-server ${PREFIX}/bin/static/notary-signer

+static: ${PREFIX}/bin/static/notary-server ${PREFIX}/bin/static/notary-signer ${PREFIX}/bin/static/notary

 	@echo "+ $@"

 notary-dockerfile:

@@ -83,8 +83,17 @@ Prerequisites:

 - Go >= 1.6.1

 - [godep](https://github.com/tools/godep) installed

 - libtool development headers installed

-    - Ubuntu: `apt-get install libtool-dev`

+    - Ubuntu: `apt-get install libltdl-dev`

     - CentOS/RedHat: `yum install libtool-ltdl-devel`

     - Mac OS ([Homebrew](http://brew.sh/)): `brew install libtool`

 Run `make binaries`, which creates the Notary Client CLI binary at `bin/notary`.

+Note that `make binaries` assumes a standard Go directory structure, in which

+Notary is checked out to the `src` directory in your `GOPATH`. For example:

+```

+$GOPATH/

+    src/

+        github.com/

+            docker/

+                notary/

+```

@@ -2,7 +2,6 @@ package client

 import (

 	"bytes"

-	"crypto/x509"

 	"encoding/json"

 	"fmt"

 	"io/ioutil"

@@ -87,7 +86,6 @@ type NotaryRepository struct {

 	CryptoService signed.CryptoService

 	tufRepo       *tuf.Repo

 	roundTrip     http.RoundTripper

-	CertStore     trustmanager.X509Store

 	trustPinning  trustpinning.TrustPinConfig

 }

@@ -97,15 +95,6 @@ type NotaryRepository struct {

 func repositoryFromKeystores(baseDir, gun, baseURL string, rt http.RoundTripper,

 	keyStores []trustmanager.KeyStore, trustPin trustpinning.TrustPinConfig) (*NotaryRepository, error) {

-	certPath := filepath.Join(baseDir, notary.TrustedCertsDir)

-	certStore, err := trustmanager.NewX509FilteredFileStore(

-		certPath,

-		trustmanager.FilterCertsExpiredSha1,

-	)

-	if err != nil {

-		return nil, err

-	}

-

 	cryptoService := cryptoservice.NewCryptoService(keyStores...)

 	nRepo := &NotaryRepository{

@@ -115,7 +104,6 @@ func repositoryFromKeystores(baseDir, gun, baseURL string, rt http.RoundTripper,

 		tufRepoPath:   filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),

 		CryptoService: cryptoService,

 		roundTrip:     rt,

-		CertStore:     certStore,

 		trustPinning:  trustPin,

 	}

@@ -162,22 +150,22 @@ func NewTarget(targetName string, targetPath string) (*Target, error) {

 	return &Target{Name: targetName, Hashes: meta.Hashes, Length: meta.Length}, nil

 }

-func rootCertKey(gun string, privKey data.PrivateKey) (*x509.Certificate, data.PublicKey, error) {

+func rootCertKey(gun string, privKey data.PrivateKey) (data.PublicKey, error) {

 	// Hard-coded policy: the generated certificate expires in 10 years.

 	startTime := time.Now()

 	cert, err := cryptoservice.GenerateCertificate(

 		privKey, gun, startTime, startTime.Add(notary.Year*10))

 	if err != nil {

-		return nil, nil, err

+		return nil, err

 	}

 	x509PublicKey := trustmanager.CertToKey(cert)

 	if x509PublicKey == nil {

-		return nil, nil, fmt.Errorf(

+		return nil, fmt.Errorf(

 			"cannot use regenerated certificate: format %s", cert.PublicKeyAlgorithm)

 	}

-	return cert, x509PublicKey, nil

+	return x509PublicKey, nil

 }

 // Initialize creates a new repository by using rootKey as the root Key for the

@@ -218,11 +206,10 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 		}

 	}

-	rootCert, rootKey, err := rootCertKey(r.gun, privKey)

+	rootKey, err := rootCertKey(r.gun, privKey)

 	if err != nil {

 		return err

 	}

-	r.CertStore.AddCert(rootCert)

 	var (

 		rootRole = data.NewBaseRole(

@@ -394,8 +381,7 @@ func (r *NotaryRepository) RemoveTarget(targetName string, roles ...string) erro

 // subtree and also the "targets/x" subtree, as we will defer parsing it until

 // we explicitly reach it in our iteration of the provided list of roles.

 func (r *NotaryRepository) ListTargets(roles ...string) ([]*TargetWithRole, error) {

-	err := r.Update(false)

-	if err != nil {

+	if err := r.Update(false); err != nil {

 		return nil, err

 	}

@@ -432,12 +418,12 @@ func (r *NotaryRepository) ListTargets(roles ...string) ([]*TargetWithRole, erro

 	return targetList, nil

 }

-// GetTargetByName returns a target given a name. If no roles are passed

+// GetTargetByName returns a target by the given name. If no roles are passed

 // it uses the targets role and does a search of the entire delegation

 // graph, finding the first entry in a breadth first search of the delegations.

 // If roles are passed, they should be passed in descending priority and

 // the target entry found in the subtree of the highest priority role

-// will be returned

+// will be returned.

 // See the IMPORTANT section on ListTargets above. Those roles also apply here.

 func (r *NotaryRepository) GetTargetByName(name string, roles ...string) (*TargetWithRole, error) {

 	if err := r.Update(false); err != nil {

@@ -656,50 +642,33 @@ func (r *NotaryRepository) publish(cl changelist.Changelist) error {

 // a not yet published repo or a possibly obsolete local copy) into

 // r.tufRepo.  This attempts to load metadata for all roles.  Since server

 // snapshots are supported, if the snapshot metadata fails to load, that's ok.

-// This can also be unified with some cache reading tools from tuf/client.

 // This assumes that bootstrapRepo is only used by Publish() or RotateKey()

 func (r *NotaryRepository) bootstrapRepo() error {

-	tufRepo := tuf.NewRepo(r.CryptoService)

+	b := tuf.NewRepoBuilder(r.gun, r.CryptoService, r.trustPinning)

 	logrus.Debugf("Loading trusted collection.")

-	rootJSON, err := r.fileStore.GetMeta(data.CanonicalRootRole, -1)

-	if err != nil {

-		return err

-	}

-	root := &data.SignedRoot{}

-	err = json.Unmarshal(rootJSON, root)

-	if err != nil {

-		return err

-	}

-	err = tufRepo.SetRoot(root)

-	if err != nil {

-		return err

-	}

-	targetsJSON, err := r.fileStore.GetMeta(data.CanonicalTargetsRole, -1)

-	if err != nil {

-		return err

-	}

-	targets := &data.SignedTargets{}

-	err = json.Unmarshal(targetsJSON, targets)

-	if err != nil {

-		return err

-	}

-	tufRepo.SetTargets(data.CanonicalTargetsRole, targets)

-	snapshotJSON, err := r.fileStore.GetMeta(data.CanonicalSnapshotRole, -1)

-	if err == nil {

-		snapshot := &data.SignedSnapshot{}

-		err = json.Unmarshal(snapshotJSON, snapshot)

+	for _, role := range data.BaseRoles {

+		jsonBytes, err := r.fileStore.GetMeta(role, store.NoSizeLimit)

 		if err != nil {

+			if _, ok := err.(store.ErrMetaNotFound); ok &&

+				// server snapshots are supported, and server timestamp management

+				// is required, so if either of these fail to load that's ok - especially

+				// if the repo is new

+				role == data.CanonicalSnapshotRole || role == data.CanonicalTimestampRole {

+				continue

+			}

+			return err

+		}

+		if err := b.Load(role, jsonBytes, 1, true); err != nil {

 			return err

 		}

-		tufRepo.SetSnapshot(snapshot)

-	} else if _, ok := err.(store.ErrMetaNotFound); !ok {

-		return err

 	}

-	r.tufRepo = tufRepo

-

+	tufRepo, err := b.Finish()

+	if err == nil {

+		r.tufRepo = tufRepo

+	}

 	return nil

 }

@@ -769,15 +738,17 @@ func (r *NotaryRepository) Update(forWrite bool) error {

 		}

 		return err

 	}

-	if err := c.Update(); err != nil {

+	repo, err := c.Update()

+	if err != nil {

 		// notFound.Resource may include a checksum so when the role is root,

-		// it will be root.json or root.<checksum>.json. Therefore best we can

+		// it will be root or root.<checksum>. Therefore best we can

 		// do it match a "root." prefix

 		if notFound, ok := err.(store.ErrMetaNotFound); ok && strings.HasPrefix(notFound.Resource, data.CanonicalRootRole+".") {

 			return r.errRepositoryNotExist()

 		}

 		return err

 	}

+	r.tufRepo = repo

 	return nil

 }

@@ -787,12 +758,9 @@ func (r *NotaryRepository) Update(forWrite bool) error {

 // is initialized or not. If set to true, we will always attempt to download

 // and return an error if the remote repository errors.

 //

-// Partially populates r.tufRepo with this root metadata (only; use

+// Populates a tuf.RepoBuilder with this root metadata (only use

 // tufclient.Client.Update to load the rest).

 //

-// As another side effect, r.CertManager's list of trusted certificates

-// is updated with data from the loaded root.json.

-//

 // Fails if the remote server is reachable and does not know the repo

 // (i.e. before the first r.Publish()), in which case the error is

 // store.ErrMetaNotFound, or if the root metadata (from whichever source is used)

@@ -801,40 +769,55 @@ func (r *NotaryRepository) Update(forWrite bool) error {

 // Returns a tufclient.Client for the remote server, which may not be actually

 // operational (if the URL is invalid but a root.json is cached).

 func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Client, error) {

-	var (

-		rootJSON   []byte

-		err        error

-		signedRoot *data.SignedRoot

-	)

-	// try to read root from cache first. We will trust this root

-	// until we detect a problem during update which will cause

-	// us to download a new root and perform a rotation.

-	rootJSON, cachedRootErr := r.fileStore.GetMeta(data.CanonicalRootRole, -1)

+	minVersion := 1

+	// the old root on disk should not be validated against any trust pinning configuration

+	// because if we have an old root, it itself is the thing that pins trust

+	oldBuilder := tuf.NewRepoBuilder(r.gun, r.CryptoService, trustpinning.TrustPinConfig{})

+

+	// by default, we want to use the trust pinning configuration on any new root that we download

+	newBuilder := tuf.NewRepoBuilder(r.gun, r.CryptoService, r.trustPinning)

+

+	// Try to read root from cache first. We will trust this root until we detect a problem

+	// during update which will cause us to download a new root and perform a rotation.

+	// If we have an old root, and it's valid, then we overwrite the newBuilder to be one

+	// preloaded with the old root or one which uses the old root for trust bootstrapping.

+	if rootJSON, err := r.fileStore.GetMeta(data.CanonicalRootRole, store.NoSizeLimit); err == nil {

+		// if we can't load the cached root, fail hard because that is how we pin trust

+		if err := oldBuilder.Load(data.CanonicalRootRole, rootJSON, minVersion, true); err != nil {

+			return nil, err

+		}

-	if cachedRootErr == nil {

-		signedRoot, cachedRootErr = r.validateRoot(rootJSON)

+		// again, the root on disk is the source of trust pinning, so use an empty trust

+		// pinning configuration

+		newBuilder = tuf.NewRepoBuilder(r.gun, r.CryptoService, trustpinning.TrustPinConfig{})

+

+		if err := newBuilder.Load(data.CanonicalRootRole, rootJSON, minVersion, false); err != nil {

+			// Ok, the old root is expired - we want to download a new one.  But we want to use the

+			// old root to verify the new root, so bootstrap a new builder with the old builder

+			minVersion = oldBuilder.GetLoadedVersion(data.CanonicalRootRole)

+			newBuilder = oldBuilder.BootstrapNewBuilder()

+		}

 	}

 	remote, remoteErr := getRemoteStore(r.baseURL, r.gun, r.roundTrip)

 	if remoteErr != nil {

 		logrus.Error(remoteErr)

-	} else if cachedRootErr != nil || checkInitialized {

-		// remoteErr was nil and we had a cachedRootErr (or are specifically

-		// checking for initialization of the repo).

+	} else if !newBuilder.IsLoaded(data.CanonicalRootRole) || checkInitialized {

+		// remoteErr was nil and we were not able to load a root from cache or

+		// are specifically checking for initialization of the repo.

 		// if remote store successfully set up, try and get root from remote

 		// We don't have any local data to determine the size of root, so try the maximum (though it is restricted at 100MB)

-		tmpJSON, err := remote.GetMeta(data.CanonicalRootRole, -1)

+		tmpJSON, err := remote.GetMeta(data.CanonicalRootRole, store.NoSizeLimit)

 		if err != nil {

 			// we didn't have a root in cache and were unable to load one from

 			// the server. Nothing we can do but error.

 			return nil, err

 		}

-		if cachedRootErr != nil {

-			// we always want to use the downloaded root if there was a cache

-			// error.

-			signedRoot, err = r.validateRoot(tmpJSON)

-			if err != nil {

+

+		if !newBuilder.IsLoaded(data.CanonicalRootRole) {

+			// we always want to use the downloaded root if we couldn't load from cache

+			if err := newBuilder.Load(data.CanonicalRootRole, tmpJSON, minVersion, false); err != nil {

 				return nil, err

 			}

@@ -846,44 +829,13 @@ func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Cl

 		}

 	}

-	r.tufRepo = tuf.NewRepo(r.CryptoService)

-

-	if signedRoot == nil {

+	// We can only get here if remoteErr != nil (hence we don't download any new root),

+	// and there was no root on disk

+	if !newBuilder.IsLoaded(data.CanonicalRootRole) {

 		return nil, ErrRepoNotInitialized{}

 	}

-	err = r.tufRepo.SetRoot(signedRoot)

-	if err != nil {

-		return nil, err

-	}

-

-	return tufclient.NewClient(

-		r.tufRepo,

-		remote,

-		r.fileStore,

-	), nil

-}

-

-// validateRoot MUST only be used during bootstrapping. It will only validate

-// signatures of the root based on known keys, not expiry or other metadata.

-// This is so that an out of date root can be loaded to be used in a rotation

-// should the TUF update process detect a problem.

-func (r *NotaryRepository) validateRoot(rootJSON []byte) (*data.SignedRoot, error) {

-	// can't just unmarshal into SignedRoot because validate root

-	// needs the root.Signed field to still be []byte for signature

-	// validation

-	root := &data.Signed{}

-	err := json.Unmarshal(rootJSON, root)

-	if err != nil {

-		return nil, err

-	}

-

-	err = trustpinning.ValidateRoot(r.CertStore, root, r.gun, r.trustPinning)

-	if err != nil {

-		return nil, err

-	}

-

-	return data.RootFromSigned(root)

+	return tufclient.NewClient(oldBuilder, newBuilder, remote, r.fileStore), nil

 }

 // RotateKey removes all existing keys associated with the role, and either

@@ -929,7 +881,7 @@ func (r *NotaryRepository) RotateKey(role string, serverManagesKey bool) error {

 		if err != nil {

 			return err

 		}

-		_, pubKey, err = rootCertKey(r.gun, privKey)

+		pubKey, err = rootCertKey(r.gun, privKey)

 		if err != nil {

 			return err

 		}

@@ -964,26 +916,12 @@ func (r *NotaryRepository) rootFileKeyChange(cl changelist.Changelist, role, act

 	return cl.Add(c)

 }

-// DeleteTrustData removes the trust data stored for this repo in the TUF cache and certificate store on the client side

+// DeleteTrustData removes the trust data stored for this repo in the TUF cache on the client side

 func (r *NotaryRepository) DeleteTrustData() error {

 	// Clear TUF files and cache

 	if err := r.fileStore.RemoveAll(); err != nil {

 		return fmt.Errorf("error clearing TUF repo data: %v", err)

 	}

 	r.tufRepo = tuf.NewRepo(nil)

-	// Clear certificates

-	certificates, err := r.CertStore.GetCertificatesByCN(r.gun)

-	if err != nil {

-		// If there were no certificates to delete, we're done

-		if _, ok := err.(*trustmanager.ErrNoCertificatesFound); ok {

-			return nil

-		}

-		return fmt.Errorf("error retrieving certificates for %s: %v", r.gun, err)

-	}

-	for _, cert := range certificates {

-		if err := r.CertStore.RemoveCert(cert); err != nil {

-			return fmt.Errorf("error removing certificate: %v: %v", cert, err)

-		}

-	}

 	return nil

 }

@@ -13,7 +13,8 @@ import (

 // NewNotaryRepository is a helper method that returns a new notary repository.

 // It takes the base directory under where all the trust files will be stored

-// (usually ~/.docker/trust/).

+// (This is normally defaults to "~/.notary" or "~/.docker/trust" when enabling

+// docker content trust).

 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,

 	retriever passphrase.Retriever, trustPinning trustpinning.TrustPinConfig) (

 	*NotaryRepository, error) {

new file mode 100644

@@ -0,0 +1,18 @@

+codecov:

+  notify:

+    # 2 builds on circleci, 1 jenkins build

+    after_n_builds: 3

+coverage:

+  status:

+    # project will give us the diff in the total code coverage between a commit

+    # and its parent

+    project:

+      default:

+        target: auto

+    # patch would give us the code coverage of the diff only

+    patch: false

+    # changes tells us if there are unexpected code coverage changes in other files

+    # which were not changed by the diff

+    changes: false

+comment: off

+

@@ -39,7 +39,7 @@ services:

       depends_on:

         - rdb-proxy

     rdb-01:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-01-data:/var/data

@@ -49,9 +49,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-01.rdb

-      command: "--bind all --no-http-admin --server-name rdb_01 --canonical-address rdb-01.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_01 --canonical-address rdb-01.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-02:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-02-data:/var/data

@@ -61,9 +61,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-02.rdb

-      command: "--bind all --no-http-admin --server-name rdb_02 --canonical-address rdb-02.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_02 --canonical-address rdb-02.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-03:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-03-data:/var/data

@@ -73,9 +73,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-03.rdb

-      command: "--bind all --no-http-admin --server-name rdb_03 --canonical-address rdb-03.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_03 --canonical-address rdb-03.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-proxy:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       ports:

         - "8080:8080"

       volumes:

@@ -85,7 +85,7 @@ services:

           aliases:

             - rdb-proxy

             - rdb-proxy.rdp

-      command: "proxy --bind all --join rdb.rdb --web-tls --web-tls-key /tls/key.pem --web-tls-cert /tls/cert.pem --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "proxy --bind all --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

       depends_on:

         - rdb-01

         - rdb-02

@@ -39,7 +39,7 @@ services:

       depends_on:

         - rdb-proxy

     rdb-01:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-01-data:/var/data

@@ -49,9 +49,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-01.rdb

-      command: "--bind all --no-http-admin --server-name rdb_01 --canonical-address rdb-01.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_01 --canonical-address rdb-01.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-02:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-02-data:/var/data

@@ -61,9 +61,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-02.rdb

-      command: "--bind all --no-http-admin --server-name rdb_02 --canonical-address rdb-02.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_02 --canonical-address rdb-02.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-03:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       volumes:

         - ./fixtures/rethinkdb:/tls

         - rdb-03-data:/var/data

@@ -73,9 +73,9 @@ services:

             - rdb

             - rdb.rdb

             - rdb-03.rdb

-      command: "--bind all --no-http-admin --server-name rdb_03 --canonical-address rdb-03.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "--bind all --no-http-admin --server-name rdb_03 --canonical-address rdb-03.rdb --directory /var/data/rethinkdb --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

     rdb-proxy:

-      image: jlhawn/rethinkdb-tls

+      image: jlhawn/rethinkdb:2.3.0

       ports:

         - "8080:8080"

       volumes:

@@ -85,7 +85,7 @@ services:

           aliases:

             - rdb-proxy

             - rdb-proxy.rdp

-      command: "proxy --bind all --join rdb.rdb --web-tls --web-tls-key /tls/key.pem --web-tls-cert /tls/cert.pem --driver-tls --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

+      command: "proxy --bind all --join rdb.rdb --driver-tls-ca /tls/ca.pem --driver-tls-key /tls/key.pem --driver-tls-cert /tls/cert.pem --cluster-tls-key /tls/key.pem --cluster-tls-cert /tls/cert.pem --cluster-tls-ca /tls/ca.pem"

       depends_on:

         - rdb-01

         - rdb-02

deleted file mode 100644

@@ -1,272 +0,0 @@

-package trustmanager

-

-import (

-	"crypto/x509"

-	"errors"

-	"os"

-	"path"

-

-	"github.com/Sirupsen/logrus"

-)

-

-// X509FileStore implements X509Store that persists on disk

-type X509FileStore struct {

-	validate       Validator

-	fileMap        map[CertID]string

-	fingerprintMap map[CertID]*x509.Certificate

-	nameMap        map[string][]CertID

-	fileStore      Storage

-}

-

-// NewX509FileStore returns a new X509FileStore.

-func NewX509FileStore(directory string) (*X509FileStore, error) {

-	validate := ValidatorFunc(func(cert *x509.Certificate) bool { return true })

-	return newX509FileStore(directory, validate)

-}

-

-// NewX509FilteredFileStore returns a new X509FileStore that validates certificates

-// that are added.

-func NewX509FilteredFileStore(directory string, validate func(*x509.Certificate) bool) (*X509FileStore, error) {

-	return newX509FileStore(directory, validate)

-}

-

-func newX509FileStore(directory string, validate func(*x509.Certificate) bool) (*X509FileStore, error) {

-	fileStore, err := NewSimpleFileStore(directory, certExtension)

-	if err != nil {

-		return nil, err

-	}

-

-	s := &X509FileStore{

-		validate:       ValidatorFunc(validate),

-		fileMap:        make(map[CertID]string),

-		fingerprintMap: make(map[CertID]*x509.Certificate),

-		nameMap:        make(map[string][]CertID),

-		fileStore:      fileStore,

-	}

-

-	err = loadCertsFromDir(s)

-	if err != nil {

-		return nil, err

-	}

-

-	return s, nil

-}

-

-// AddCert creates a filename for a given cert and adds a certificate with that name

-func (s *X509FileStore) AddCert(cert *x509.Certificate) error {

-	if cert == nil {

-		return errors.New("adding nil Certificate to X509Store")

-	}

-

-	// Check if this certificate meets our validation criteria

-	if !s.validate.Validate(cert) {

-		return &ErrCertValidation{}

-	}

-	// Attempt to write the certificate to the file

-	if err := s.addNamedCert(cert); err != nil {

-		return err

-	}

-

-	return nil

-}

-

-// addNamedCert allows adding a certificate while controlling the filename it gets

-// stored under. If the file does not exist on disk, saves it.

-func (s *X509FileStore) addNamedCert(cert *x509.Certificate) error {

-	fileName, certID, err := fileName(cert)

-	if err != nil {

-		return err

-	}

-

-	logrus.Debug("Adding cert with certID: ", certID)

-	// Validate if we already added this certificate before

-	if _, ok := s.fingerprintMap[certID]; ok {

-		return &ErrCertExists{}

-	}

-

-	// Convert certificate to PEM

-	certBytes := CertToPEM(cert)

-

-	// Save the file to disk if not already there.

-	if _, err = s.fileStore.Get(fileName); os.IsNotExist(err) {

-		if err := s.fileStore.Add(fileName, certBytes); err != nil {

-			return err

-		}

-	} else if err != nil {

-		return err

-	}

-

-	// We wrote the certificate succcessfully, add it to our in-memory storage

-	s.fingerprintMap[certID] = cert

-	s.fileMap[certID] = fileName

-

-	name := string(cert.Subject.CommonName)

-	s.nameMap[name] = append(s.nameMap[name], certID)

-

-	return nil

-}

-

-// RemoveCert removes a certificate from a X509FileStore.

-func (s *X509FileStore) RemoveCert(cert *x509.Certificate) error {

-	if cert == nil {

-		return errors.New("removing nil Certificate from X509Store")

-	}

-

-	certID, err := fingerprintCert(cert)

-	if err != nil {

-		return err

-	}

-	delete(s.fingerprintMap, certID)

-	filename := s.fileMap[certID]

-	delete(s.fileMap, certID)

-

-	name := string(cert.Subject.CommonName)

-

-	// Filter the fingerprint out of this name entry

-	fpList := s.nameMap[name]

-	newfpList := fpList[:0]

-	for _, x := range fpList {

-		if x != certID {

-			newfpList = append(newfpList, x)

-		}

-	}

-

-	s.nameMap[name] = newfpList

-

-	if err := s.fileStore.Remove(filename); err != nil {

-		return err

-	}

-

-	return nil

-}

-

-// RemoveAll removes all the certificates from the store

-func (s *X509FileStore) RemoveAll() error {

-	for _, filename := range s.fileMap {

-		if err := s.fileStore.Remove(filename); err != nil {

-			return err

-		}

-	}

-	s.fileMap = make(map[CertID]string)

-	s.fingerprintMap = make(map[CertID]*x509.Certificate)

-	s.nameMap = make(map[string][]CertID)

-

-	return nil

-}

-

-// AddCertFromPEM adds the first certificate that it finds in the byte[], returning

-// an error if no Certificates are found

-func (s X509FileStore) AddCertFromPEM(pemBytes []byte) error {

-	cert, err := LoadCertFromPEM(pemBytes)

-	if err != nil {

-		return err

-	}

-	return s.AddCert(cert)

-}

-

-// AddCertFromFile tries to adds a X509 certificate to the store given a filename

-func (s *X509FileStore) AddCertFromFile(filename string) error {

-	cert, err := LoadCertFromFile(filename)

-	if err != nil {

-		return err

-	}

-

-	return s.AddCert(cert)

-}

-

-// GetCertificates returns an array with all of the current X509 Certificates.

-func (s *X509FileStore) GetCertificates() []*x509.Certificate {

-	certs := make([]*x509.Certificate, len(s.fingerprintMap))

-	i := 0

-	for _, v := range s.fingerprintMap {

-		certs[i] = v

-		i++

-	}

-	return certs

-}

-

-// GetCertificatePool returns an x509 CertPool loaded with all the certificates

-// in the store.

-func (s *X509FileStore) GetCertificatePool() *x509.CertPool {

-	pool := x509.NewCertPool()

-

-	for _, v := range s.fingerprintMap {

-		pool.AddCert(v)

-	}

-	return pool

-}

-

-// GetCertificateByCertID returns the certificate that matches a certain certID

-func (s *X509FileStore) GetCertificateByCertID(certID string) (*x509.Certificate, error) {

-	return s.getCertificateByCertID(CertID(certID))

-}

-

-// getCertificateByCertID returns the certificate that matches a certain certID

-func (s *X509FileStore) getCertificateByCertID(certID CertID) (*x509.Certificate, error) {

-	// If it does not look like a hex encoded sha256 hash, error

-	if len(certID) != 64 {

-		return nil, errors.New("invalid Subject Key Identifier")

-	}

-

-	// Check to see if this subject key identifier exists

-	if cert, ok := s.fingerprintMap[CertID(certID)]; ok {

-		return cert, nil

-

-	}

-	return nil, &ErrNoCertificatesFound{query: string(certID)}

-}

-

-// GetCertificatesByCN returns all the certificates that match a specific

-// CommonName

-func (s *X509FileStore) GetCertificatesByCN(cn string) ([]*x509.Certificate, error) {

-	var certs []*x509.Certificate

-	if ids, ok := s.nameMap[cn]; ok {

-		for _, v := range ids {

-			cert, err := s.getCertificateByCertID(v)

-			if err != nil {

-				// This error should never happen. This would mean that we have

-				// an inconsistent X509FileStore

-				return nil, &ErrBadCertificateStore{}

-			}

-			certs = append(certs, cert)

-		}

-	}

-	if len(certs) == 0 {

-		return nil, &ErrNoCertificatesFound{query: cn}

-	}

-

-	return certs, nil

-}

-

-// GetVerifyOptions returns VerifyOptions with the certificates within the KeyStore