@@ -169,7 +169,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary server

-ENV NOTARY_VERSION docker-v1.10-5

+ENV NOTARY_VERSION v0.2.0

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -119,7 +119,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary server

-ENV NOTARY_VERSION docker-v1.10-5

+ENV NOTARY_VERSION v0.2.0

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -135,7 +135,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary server

-ENV NOTARY_VERSION docker-v1.10-5

+ENV NOTARY_VERSION v0.2.0

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -127,16 +127,16 @@ RUN set -x \

 		go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \

 	&& rm -rf "$GOPATH"

-# TODO update this when we upgrade to Go 1.5.1+

+

 # Install notary server

-#ENV NOTARY_VERSION docker-v1.10-5

-#RUN set -x \

-#	&& export GOPATH="$(mktemp -d)" \

-#	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

-#	&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \

-#	&& GOPATH="$GOPATH/src/github.com/docker/notary/Godeps/_workspace:$GOPATH" \

-#		go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \

-#	&& rm -rf "$GOPATH"

+ENV NOTARY_VERSION v0.2.0

+RUN set -x \

+	&& export GOPATH="$(mktemp -d)" \

+	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

+	&& (cd "$GOPATH/src/github.com/docker/notary" && git checkout -q "$NOTARY_VERSION") \

+	&& GOPATH="$GOPATH/src/github.com/docker/notary/Godeps/_workspace:$GOPATH" \

+		go build -o /usr/local/bin/notary-server github.com/docker/notary/cmd/notary-server \

+	&& rm -rf "$GOPATH"

 # Get the "docker-py" source so we can run their integration tests

 ENV DOCKER_PY_COMMIT e2878cbcc3a7eef99917adc1be252800b0e41ece

@@ -108,7 +108,7 @@ RUN set -x \

 	&& rm -rf "$GOPATH"

 # Install notary server

-ENV NOTARY_VERSION docker-v1.10-5

+ENV NOTARY_VERSION v0.2.0

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/notary.git "$GOPATH/src/github.com/docker/notary" \

@@ -52,7 +52,7 @@ clone git github.com/docker/distribution 7b66c50bb7e0e4b3b83f8fd134a9f6ea4be08b5

 clone git github.com/vbatts/tar-split v0.9.11

 # get desired notary commit, might also need to be updated in Dockerfile

-clone git github.com/docker/notary docker-v1.10-5

+clone git github.com/docker/notary v0.2.0

 clone git google.golang.org/grpc 174192fc93efcb188fc8f46ca447f0da606b6885 https://github.com/grpc/grpc-go.git

 clone git github.com/miekg/pkcs11 80f102b5cac759de406949c47f0928b99bd64cdf

@@ -365,7 +365,7 @@ func (s *DockerTrustSuite) TestCreateWhenCertExpired(c *check.C) {

 func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	repoName := fmt.Sprintf("%v/dockerclievilcreate/trusted:latest", privateRegistryURL)

-	evilLocalConfigDir, err := ioutil.TempDir("", "evil-local-config-dir")

+	evilLocalConfigDir, err := ioutil.TempDir("", "evilcreate-local-config-dir")

 	c.Assert(err, check.IsNil)

 	// tag the image and upload it to the private registry

@@ -404,12 +404,16 @@ func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	c.Assert(err, check.IsNil)

 	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push:\n%s", out))

-	// Now, try creating with the original client from this new trust server. This should fail.

+	// Now, try creating with the original client from this new trust server. This should fallback to our cached timestamp and metadata.

 	createCmd = exec.Command(dockerBinary, "create", repoName)

 	s.trustedCmd(createCmd)

 	out, _, err = runCommandWithOutput(createCmd)

-	c.Assert(err, check.Not(check.IsNil))

-	c.Assert(string(out), checker.Contains, "valid signatures did not meet threshold", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	if err != nil {

+		c.Fatalf("Error falling back to cached trust data: %s\n%s", err, out)

+	}

+	if !strings.Contains(string(out), "Error while downloading remote metadata, using cached timestamp") {

+		c.Fatalf("Missing expected output on trusted create:\n%s", out)

+	}

 }

@@ -135,13 +135,16 @@ func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {

 	c.Assert(err, check.IsNil, check.Commentf(out))

 	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))

-	// Now, try pulling with the original client from this new trust server. This should fail.

+	// Now, try pulling with the original client from this new trust server. This should fall back to cached metadata.

 	pullCmd = exec.Command(dockerBinary, "pull", repoName)

 	s.trustedCmd(pullCmd)

 	out, _, err = runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "valid signatures did not meet threshold", check.Commentf(out))

+	if err != nil {

+		c.Fatalf("Error falling back to cached trust data: %s\n%s", err, out)

+	}

+	if !strings.Contains(string(out), "Error while downloading remote metadata, using cached timestamp") {

+		c.Fatalf("Missing expected output on trusted pull:\n%s", out)

+	}

 }

 func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {

@@ -3260,7 +3260,7 @@ func (s *DockerTrustSuite) TestTrustedRunFromBadTrustServer(c *check.C) {

 	// Windows does not support this functionality

 	testRequires(c, DaemonIsLinux)

 	repoName := fmt.Sprintf("%v/dockerclievilrun/trusted:latest", privateRegistryURL)

-	evilLocalConfigDir, err := ioutil.TempDir("", "evil-local-config-dir")

+	evilLocalConfigDir, err := ioutil.TempDir("", "evilrun-local-config-dir")

 	if err != nil {

 		c.Fatalf("Failed to create local temp dir")

 	}

@@ -3316,15 +3316,15 @@ func (s *DockerTrustSuite) TestTrustedRunFromBadTrustServer(c *check.C) {

 		c.Fatalf("Missing expected output on trusted push:\n%s", out)

 	}

-	// Now, try running with the original client from this new trust server. This should fail.

+	// Now, try running with the original client from this new trust server. This should fallback to our cached timestamp and metadata.

 	runCmd = exec.Command(dockerBinary, "run", repoName)

 	s.trustedCmd(runCmd)

 	out, _, err = runCommandWithOutput(runCmd)

-	if err == nil {

-		c.Fatalf("Expected to fail on this run due to different remote data: %s\n%s", err, out)

-	}

-	if !strings.Contains(string(out), "valid signatures did not meet threshold") {

+	if err != nil {

+		c.Fatalf("Error falling back to cached trust data: %s\n%s", err, out)

+	}

+	if !strings.Contains(string(out), "Error while downloading remote metadata, using cached timestamp") {

 		c.Fatalf("Missing expected output on trusted push:\n%s", out)

 	}

 }

@@ -237,7 +237,7 @@ func (s *DockerTrustSuite) setupDelegations(c *check.C, repoName, pwd string) {

 	if err != nil {

 		c.Fatalf("Error creating delegation key: %s\n", err)

 	}

-	err = nRepo.AddDelegation("targets/releases", 1, []data.PublicKey{delgKey}, []string{""})

+	err = nRepo.AddDelegation("targets/releases", []data.PublicKey{delgKey}, []string{""})

 	if err != nil {

 		c.Fatalf("Error creating delegation: %s\n", err)

 	}

@@ -42,14 +42,6 @@ GO_VERSION = $(shell go version | awk '{print $$3}')

 .DELETE_ON_ERROR: cover

 .DEFAULT: default

-go_version:

-ifeq (,$(findstring go1.5.,$(GO_VERSION)))

-	$(error Requires go version 1.5.x - found $(GO_VERSION))

-else

-	@echo

-endif

-

-

 all: AUTHORS clean fmt vet fmt lint build test binaries

 AUTHORS: .git/HEAD

@@ -71,7 +63,23 @@ ${PREFIX}/bin/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')

 	@echo "+ $@"

 	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-signer

-vet: go_version

+ifeq ($(shell uname -s),Darwin)

+${PREFIX}/bin/static/notary-server:

+	@echo "notary-server: static builds not supported on OS X"

+

+${PREFIX}/bin/static/notary-signer:

+	@echo "notary-signer: static builds not supported on OS X"

+else

+${PREFIX}/bin/static/notary-server: NOTARY_VERSION $(shell find . -type f -name '*.go')

+	@echo "+ $@"

+	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS_STATIC} ./cmd/notary-server

+

+${PREFIX}/bin/static/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')

+	@echo "+ $@"

+	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS_STATIC} ./cmd/notary-signer

+endif

+

+vet: 

 	@echo "+ $@"

 ifeq ($(shell uname -s), Darwin)

 	@test -z "$(shell find . -iname *test*.go | grep -v _test.go | grep -v Godeps | xargs echo "This file should end with '_test':"  | tee /dev/stderr)"

@@ -88,14 +96,24 @@ lint:

 	@echo "+ $@"

 	@test -z "$$(golint ./... | grep -v .pb. | grep -v Godeps/_workspace/src/ | tee /dev/stderr)"

-build: go_version

+# Requires that the following:

+# go get -u github.com/client9/misspell/cmd/misspell

+#

+# be run first

+

+# misspell target, don't include Godeps, binaries, python tests, or git files

+misspell:

+	@echo "+ $@"

+	@test -z "$$(find . -name '*' | grep -v Godeps/_workspace/src/ | grep -v bin/ | grep -v misc/ | grep -v .git/ | xargs misspell | tee /dev/stderr)"

+

+build:

 	@echo "+ $@"

 	@go build -tags "${NOTARY_BUILDTAGS}" -v ${GO_LDFLAGS} ./...

 # When running `go test ./...`, it runs all the suites in parallel, which causes

 # problems when running with a yubikey

 test: TESTOPTS =

-test: go_version

+test: 

 	@echo Note: when testing with a yubikey plugged in, make sure to include 'TESTOPTS="-p 1"'

 	@echo "+ $@ $(TESTOPTS)"

 	@echo

@@ -121,7 +139,7 @@ define gocover

 $(GO_EXC) test $(OPTS) $(TESTOPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).$(subst $(_space),.,$(NOTARY_BUILDTAGS)).coverage.txt" "$(1)" || exit 1;

 endef

-gen-cover: go_version

+gen-cover: 

 	@mkdir -p "$(COVERDIR)"

 	$(foreach PKG,$(PKGS),$(call gocover,$(PKG)))

 	rm -f "$(COVERDIR)"/*testutils*.coverage.txt

@@ -150,7 +168,10 @@ covmerge:

 clean-protos:

 	@rm proto/*.pb.go

-binaries: go_version ${PREFIX}/bin/notary-server ${PREFIX}/bin/notary ${PREFIX}/bin/notary-signer

+binaries: ${PREFIX}/bin/notary-server ${PREFIX}/bin/notary ${PREFIX}/bin/notary-signer

+	@echo "+ $@"

+

+static: ${PREFIX}/bin/static/notary-server ${PREFIX}/bin/static/notary-signer

 	@echo "+ $@"

 define template

@@ -158,7 +179,7 @@ mkdir -p ${PREFIX}/cross/$(1)/$(2);

 GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 go build -o ${PREFIX}/cross/$(1)/$(2)/notary -a -tags "static_build netgo" -installsuffix netgo ${GO_LDFLAGS_STATIC} ./cmd/notary;

 endef

-cross: go_version

+cross: 

 	$(foreach GOARCH,$(GOARCHS),$(foreach GOOS,$(GOOSES),$(call template,$(GOOS),$(GOARCH))))

@@ -1,4 +1,5 @@

-# Notary [![Circle CI](https://circleci.com/gh/docker/notary/tree/master.svg?style=shield)](https://circleci.com/gh/docker/notary/tree/master)

+# Notary 

+[![Circle CI](https://circleci.com/gh/docker/notary/tree/master.svg?style=shield)](https://circleci.com/gh/docker/notary/tree/master) [![CodeCov](https://codecov.io/github/docker/notary/coverage.svg?branch=master)](https://codecov.io/github/docker/notary)

 The Notary project comprises a [server](cmd/notary-server) and a [client](cmd/notary) for running and interacting

 with trusted collections.

@@ -6,7 +6,7 @@ machine:

   post:

   # Install many go versions

-    - gvm install go1.5.1 -B --name=stable

+    - gvm install go1.6 -B --name=stable

   environment:

   # Convenient shortcuts to "common" locations

@@ -37,10 +37,11 @@ dependencies:

         pwd: $BASE_STABLE

   post:

-  # For the stable go version, additionally install linting tools

+  # For the stable go version, additionally install linting and misspell tools

     - >

       gvm use stable &&

-      go get github.com/golang/lint/golint

+      go get github.com/golang/lint/golint &&

+      go get -u github.com/client9/misspell/cmd/misspell

 test:

   pre:

   # Output the go versions we are going to test

@@ -62,6 +63,10 @@ test:

     - gvm use stable && make lint:

         pwd: $BASE_STABLE

+  # MISSPELL

+    - gvm use stable && make misspell:

+        pwd: $BASE_STABLE

+

   override:

   # Test stable, and report

   # hacking this to be parallel

@@ -17,7 +17,7 @@ const (

 // Types for TufChanges are namespaced by the Role they

 // are relevant for. The Root and Targets roles are the

 // only ones for which user action can cause a change, as

-// all changes in Snapshot and Timestamp are programatically

+// all changes in Snapshot and Timestamp are programmatically

 // generated base on Root and Targets changes.

 const (

 	TypeRootRole          = "role"

@@ -82,14 +82,13 @@ func (c TufChange) Content() []byte {

 // this includes creating a delegations. This format is used to avoid

 // unexpected race conditions between humans modifying the same delegation

 type TufDelegation struct {

-	NewName                string       `json:"new_name,omitempty"`

-	NewThreshold           int          `json:"threshold, omitempty"`

-	AddKeys                data.KeyList `json:"add_keys, omitempty"`

-	RemoveKeys             []string     `json:"remove_keys,omitempty"`

-	AddPaths               []string     `json:"add_paths,omitempty"`

-	RemovePaths            []string     `json:"remove_paths,omitempty"`

-	AddPathHashPrefixes    []string     `json:"add_prefixes,omitempty"`

-	RemovePathHashPrefixes []string     `json:"remove_prefixes,omitempty"`

+	NewName       string       `json:"new_name,omitempty"`

+	NewThreshold  int          `json:"threshold, omitempty"`

+	AddKeys       data.KeyList `json:"add_keys, omitempty"`

+	RemoveKeys    []string     `json:"remove_keys,omitempty"`

+	AddPaths      []string     `json:"add_paths,omitempty"`

+	RemovePaths   []string     `json:"remove_paths,omitempty"`

+	ClearAllPaths bool         `json:"clear_paths,omitempty"`

 }

 // ToNewRole creates a fresh role object from the TufDelegation data

@@ -98,5 +97,5 @@ func (td TufDelegation) ToNewRole(scope string) (*data.Role, error) {

 	if td.NewName != "" {

 		name = td.NewName

 	}

-	return data.NewRole(name, td.NewThreshold, td.AddKeys.IDs(), td.AddPaths, td.AddPathHashPrefixes)

+	return data.NewRole(name, td.NewThreshold, td.AddKeys.IDs(), td.AddPaths)

 }

@@ -9,6 +9,7 @@ import (

 	"net/url"

 	"os"

 	"path/filepath"

+	"strings"

 	"time"

 	"github.com/Sirupsen/logrus"

@@ -20,23 +21,13 @@ import (

 	"github.com/docker/notary/tuf"

 	tufclient "github.com/docker/notary/tuf/client"

 	"github.com/docker/notary/tuf/data"

-	"github.com/docker/notary/tuf/keys"

 	"github.com/docker/notary/tuf/signed"

 	"github.com/docker/notary/tuf/store"

-)

-

-const (

-	maxSize = 5 << 20

+	"github.com/docker/notary/tuf/utils"

 )

 func init() {

-	data.SetDefaultExpiryTimes(

-		map[string]int{

-			"root":     3650,

-			"targets":  1095,

-			"snapshot": 1095,

-		},

-	)

+	data.SetDefaultExpiryTimes(notary.NotaryDefaultExpiries)

 }

 // ErrRepoNotInitialized is returned when trying to publish an uninitialized

@@ -118,7 +109,6 @@ func repositoryFromKeystores(baseDir, gun, baseURL string, rt http.RoundTripper,

 		nRepo.tufRepoPath,

 		"metadata",

 		"json",

-		"",

 	)

 	if err != nil {

 		return nil, err

@@ -218,11 +208,16 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 		return fmt.Errorf("invalid format for root key: %s", privKey.Algorithm())

 	}

-	kdb := keys.NewDB()

-	err = addKeyForRole(kdb, data.CanonicalRootRole, rootKey)

-	if err != nil {

-		return err

-	}

+	var (

+		rootRole = data.NewBaseRole(

+			data.CanonicalRootRole,

+			notary.MinThreshold,

+			rootKey,

+		)

+		timestampRole data.BaseRole

+		snapshotRole  data.BaseRole

+		targetsRole   data.BaseRole

+	)

 	// we want to create all the local keys first so we don't have to

 	// make unnecessary network calls

@@ -232,8 +227,19 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 		if err != nil {

 			return err

 		}

-		if err := addKeyForRole(kdb, role, key); err != nil {

-			return err

+		switch role {

+		case data.CanonicalSnapshotRole:

+			snapshotRole = data.NewBaseRole(

+				role,

+				notary.MinThreshold,

+				key,

+			)

+		case data.CanonicalTargetsRole:

+			targetsRole = data.NewBaseRole(

+				role,

+				notary.MinThreshold,

+				key,

+			)

 		}

 	}

 	for _, role := range remotelyManagedKeys {

@@ -244,14 +250,31 @@ func (r *NotaryRepository) Initialize(rootKeyID string, serverManagedRoles ...st

 		}

 		logrus.Debugf("got remote %s %s key with keyID: %s",

 			role, key.Algorithm(), key.ID())

-		if err := addKeyForRole(kdb, role, key); err != nil {

-			return err

+		switch role {

+		case data.CanonicalSnapshotRole:

+			snapshotRole = data.NewBaseRole(

+				role,

+				notary.MinThreshold,

+				key,

+			)

+		case data.CanonicalTimestampRole:

+			timestampRole = data.NewBaseRole(

+				role,

+				notary.MinThreshold,

+				key,

+			)

 		}

 	}

-	r.tufRepo = tuf.NewRepo(kdb, r.CryptoService)

+	r.tufRepo = tuf.NewRepo(r.CryptoService)

-	err = r.tufRepo.InitRoot(false)

+	err = r.tufRepo.InitRoot(

+		rootRole,

+		timestampRole,

+		snapshotRole,

+		targetsRole,

+		false,

+	)

 	if err != nil {

 		logrus.Debug("Error on InitRoot: ", err.Error())

 		return err

@@ -305,96 +328,6 @@ func addChange(cl *changelist.FileChangelist, c changelist.Change, roles ...stri

 	return nil

 }

-// AddDelegation creates a new changelist entry to add a delegation to the repository

-// when the changelist gets applied at publish time.  This does not do any validation

-// other than checking the name of the delegation to add - all that will happen

-// at publish time.

-func (r *NotaryRepository) AddDelegation(name string, threshold int,

-	delegationKeys []data.PublicKey, paths []string) error {

-

-	if !data.IsDelegation(name) {

-		return data.ErrInvalidRole{Role: name, Reason: "invalid delegation role name"}

-	}

-

-	cl, err := changelist.NewFileChangelist(filepath.Join(r.tufRepoPath, "changelist"))

-	if err != nil {

-		return err

-	}

-	defer cl.Close()

-

-	logrus.Debugf(`Adding delegation "%s" with threshold %d, and %d keys\n`,

-		name, threshold, len(delegationKeys))

-

-	tdJSON, err := json.Marshal(&changelist.TufDelegation{

-		NewThreshold: threshold,

-		AddKeys:      data.KeyList(delegationKeys),

-		AddPaths:     paths,

-	})

-	if err != nil {

-		return err

-	}

-

-	template := changelist.NewTufChange(

-		changelist.ActionCreate,

-		name,

-		changelist.TypeTargetsDelegation,

-		"", // no path

-		tdJSON,

-	)

-

-	return addChange(cl, template, name)

-}

-

-// RemoveDelegation creates a new changelist entry to remove a delegation from

-// the repository when the changelist gets applied at publish time.

-// This does not validate that the delegation exists, since one might exist

-// after applying all changes.

-func (r *NotaryRepository) RemoveDelegation(name string, keyIDs, paths []string, removeAll bool) error {

-

-	if !data.IsDelegation(name) {

-		return data.ErrInvalidRole{Role: name, Reason: "invalid delegation role name"}

-	}

-

-	cl, err := changelist.NewFileChangelist(filepath.Join(r.tufRepoPath, "changelist"))

-	if err != nil {

-		return err

-	}

-	defer cl.Close()

-

-	logrus.Debugf(`Removing delegation "%s"\n`, name)

-	var template *changelist.TufChange

-

-	// We use the Delete action only for force removal, Update is used for removing individual keys and paths

-	if removeAll {

-		template = changelist.NewTufChange(

-			changelist.ActionDelete,

-			name,

-			changelist.TypeTargetsDelegation,

-			"",  // no path

-			nil, // deleting role, no data needed

-		)

-

-	} else {

-		tdJSON, err := json.Marshal(&changelist.TufDelegation{

-			RemoveKeys:  keyIDs,

-			RemovePaths: paths,

-		})

-		if err != nil {

-			return err

-		}

-

-		template = changelist.NewTufChange(

-			changelist.ActionUpdate,

-			name,

-			changelist.TypeTargetsDelegation,

-			"", // no path

-			tdJSON,

-		)

-	}

-

-	return addChange(cl, template, name)

-}

-

 // AddTarget creates new changelist entries to add a target to the given roles

 // in the repository when the changelist gets applied at publish time.

 // If roles are unspecified, the default role is "targets".

@@ -452,10 +385,24 @@ func (r *NotaryRepository) ListTargets(roles ...string) ([]*TargetWithRole, erro

 	}

 	targets := make(map[string]*TargetWithRole)

 	for _, role := range roles {

-		// we don't need to do anything special with removing role from

-		// roles because listSubtree always processes role and only excludes

-		// descendant delegations that appear in roles.

-		r.listSubtree(targets, role, roles...)

+		// Define an array of roles to skip for this walk (see IMPORTANT comment above)

+		skipRoles := utils.StrSliceRemove(roles, role)

+

+		// Define a visitor function to populate the targets map in priority order

+		listVisitorFunc := func(tgt *data.SignedTargets, validRole data.DelegationRole) interface{} {

+			// We found targets so we should try to add them to our targets map

+			for targetName, targetMeta := range tgt.Signed.Targets {

+				// Follow the priority by not overriding previously set targets

+				// and check that this path is valid with this role

+				if _, ok := targets[targetName]; ok || !validRole.CheckPaths(targetName) {

+					continue

+				}

+				targets[targetName] =

+					&TargetWithRole{Target: Target{Name: targetName, Hashes: targetMeta.Hashes, Length: targetMeta.Length}, Role: validRole.Name}

+			}

+			return nil

+		}

+		r.tufRepo.WalkTargets("", role, listVisitorFunc, skipRoles...)

 	}

 	var targetList []*TargetWithRole

@@ -466,34 +413,6 @@ func (r *NotaryRepository) ListTargets(roles ...string) ([]*TargetWithRole, erro

 	return targetList, nil

 }

-func (r *NotaryRepository) listSubtree(targets map[string]*TargetWithRole, role string, exclude ...string) {

-	excl := make(map[string]bool)

-	for _, r := range exclude {

-		excl[r] = true

-	}

-	roles := []string{role}

-	for len(roles) > 0 {

-		role = roles[0]

-		roles = roles[1:]

-		tgts, ok := r.tufRepo.Targets[role]

-		if !ok {

-			// not every role has to exist

-			continue

-		}

-		for name, meta := range tgts.Signed.Targets {

-			if _, ok := targets[name]; !ok {

-				targets[name] = &TargetWithRole{

-					Target: Target{Name: name, Hashes: meta.Hashes, Length: meta.Length}, Role: role}

-			}

-		}

-		for _, d := range tgts.Signed.Delegations.Roles {

-			if !excl[d.Name] {

-				roles = append(roles, d.Name)

-			}

-		}

-	}

-}

-

 // GetTargetByName returns a target given a name. If no roles are passed

 // it uses the targets role and does a search of the entire delegation

 // graph, finding the first entry in a breadth first search of the delegations.

@@ -502,7 +421,7 @@ func (r *NotaryRepository) listSubtree(targets map[string]*TargetWithRole, role

 // will be returned

 // See the IMPORTANT section on ListTargets above. Those roles also apply here.

 func (r *NotaryRepository) GetTargetByName(name string, roles ...string) (*TargetWithRole, error) {

-	c, err := r.Update(false)

+	_, err := r.Update(false)

 	if err != nil {

 		return nil, err

 	}

@@ -510,11 +429,30 @@ func (r *NotaryRepository) GetTargetByName(name string, roles ...string) (*Targe

 	if len(roles) == 0 {

 		roles = append(roles, data.CanonicalTargetsRole)

 	}

+	var resultMeta data.FileMeta

+	var resultRoleName string

+	var foundTarget bool

 	for _, role := range roles {

-		meta, foundRole := c.TargetMeta(role, name, roles...)

-		if meta != nil {

-			return &TargetWithRole{

-				Target: Target{Name: name, Hashes: meta.Hashes, Length: meta.Length}, Role: foundRole}, nil

+		// Define an array of roles to skip for this walk (see IMPORTANT comment above)

+		skipRoles := utils.StrSliceRemove(roles, role)

+

+		// Define a visitor function to find the specified target

+		getTargetVisitorFunc := func(tgt *data.SignedTargets, validRole data.DelegationRole) interface{} {

+			if tgt == nil {

+				return nil

+			}

+			// We found the target and validated path compatibility in our walk,

+			// so we should stop our walk and set the resultMeta and resultRoleName variables

+			if resultMeta, foundTarget = tgt.Signed.Targets[name]; foundTarget {

+				resultRoleName = validRole.Name

+				return tuf.StopWalk{}

+			}

+			return nil

+		}

+		err = r.tufRepo.WalkTargets(name, role, getTargetVisitorFunc, skipRoles...)

+		// Check that we didn't error, and that we assigned to our target

+		if err == nil && foundTarget {

+			return &TargetWithRole{Target: Target{Name: name, Hashes: resultMeta.Hashes, Length: resultMeta.Length}, Role: resultRoleName}, nil

 		}

 	}

 	return nil, fmt.Errorf("No trust data for %s", name)

@@ -532,45 +470,6 @@ func (r *NotaryRepository) GetChangelist() (changelist.Changelist, error) {

 	return cl, nil

 }

-// GetDelegationRoles returns the keys and roles of the repository's delegations

-func (r *NotaryRepository) GetDelegationRoles() ([]*data.Role, error) {

-	// Update state of the repo to latest

-	if _, err := r.Update(false); err != nil {

-		return nil, err

-	}

-

-	// All top level delegations (ex: targets/level1) are stored exclusively in targets.json

-	targets, ok := r.tufRepo.Targets[data.CanonicalTargetsRole]

-	if !ok {

-		return nil, store.ErrMetaNotFound{Resource: data.CanonicalTargetsRole}

-	}

-

-	allDelegations := targets.Signed.Delegations.Roles

-

-	// make a copy for traversing nested delegations

-	delegationsList := make([]*data.Role, len(allDelegations))

-	copy(delegationsList, allDelegations)

-

-	// Now traverse to lower level delegations (ex: targets/level1/level2)

-	for len(delegationsList) > 0 {

-		// Pop off first delegation to traverse

-		delegation := delegationsList[0]

-		delegationsList = delegationsList[1:]

-

-		// Get metadata

-		delegationMeta, ok := r.tufRepo.Targets[delegation.Name]

-		// If we get an error, don't try to traverse further into this subtree because it doesn't exist or is malformed

-		if !ok {

-			continue

-		}

-

-		// Add nested delegations to return list and exploration list

-		allDelegations = append(allDelegations, delegationMeta.Signed.Delegations.Roles...)

-		delegationsList = append(delegationsList, delegationMeta.Signed.Delegations.Roles...)

-	}

-	return allDelegations, nil

-}

-

 // RoleWithSignatures is a Role with its associated signatures

 type RoleWithSignatures struct {

 	Signatures []data.Signature

@@ -604,7 +503,7 @@ func (r *NotaryRepository) ListRoles() ([]RoleWithSignatures, error) {

 		case data.CanonicalTimestampRole:

 			roleWithSig.Signatures = r.tufRepo.Timestamp.Signatures

 		default:

-			// If the role isn't a delegation, we should error -- this is only possible if we have invalid keyDB state

+			// If the role isn't a delegation, we should error -- this is only possible if we have invalid state

 			if !data.IsDelegation(role.Name) {

 				return nil, data.ErrInvalidRole{Role: role.Name, Reason: "invalid role name"}

 			}

@@ -705,7 +604,7 @@ func (r *NotaryRepository) Publish() error {

 		r.tufRepo, data.CanonicalSnapshotRole)

 	if err == nil {

-		// Only update the snapshot if we've sucessfully signed it.

+		// Only update the snapshot if we've successfully signed it.

 		updatedFiles[data.CanonicalSnapshotRole] = snapshotJSON

 	} else if _, ok := err.(signed.ErrNoKeys); ok {

 		// If signing fails due to us not having the snapshot key, then

@@ -743,11 +642,10 @@ func (r *NotaryRepository) Publish() error {

 // This can also be unified with some cache reading tools from tuf/client.

 // This assumes that bootstrapRepo is only used by Publish()

 func (r *NotaryRepository) bootstrapRepo() error {

-	kdb := keys.NewDB()

-	tufRepo := tuf.NewRepo(kdb, r.CryptoService)

+	tufRepo := tuf.NewRepo(r.CryptoService)

 	logrus.Debugf("Loading trusted collection.")

-	rootJSON, err := r.fileStore.GetMeta("root", 0)

+	rootJSON, err := r.fileStore.GetMeta("root", -1)

 	if err != nil {

 		return err

 	}

@@ -760,7 +658,7 @@ func (r *NotaryRepository) bootstrapRepo() error {

 	if err != nil {

 		return err

 	}

-	targetsJSON, err := r.fileStore.GetMeta("targets", 0)

+	targetsJSON, err := r.fileStore.GetMeta("targets", -1)

 	if err != nil {

 		return err

 	}

@@ -771,7 +669,7 @@ func (r *NotaryRepository) bootstrapRepo() error {

 	}

 	tufRepo.SetTargets("targets", targets)

-	snapshotJSON, err := r.fileStore.GetMeta("snapshot", 0)

+	snapshotJSON, err := r.fileStore.GetMeta("snapshot", -1)

 	if err == nil {

 		snapshot := &data.SignedSnapshot{}

 		err = json.Unmarshal(snapshotJSON, snapshot)

@@ -854,7 +752,10 @@ func (r *NotaryRepository) Update(forWrite bool) (*tufclient.Client, error) {

 	}

 	err = c.Update()

 	if err != nil {

-		if notFound, ok := err.(store.ErrMetaNotFound); ok && notFound.Resource == data.CanonicalRootRole {

+		// notFound.Resource may include a checksum so when the role is root,

+		// it will be root.json or root.<checksum>.json. Therefore best we can

+		// do it match a "root." prefix

+		if notFound, ok := err.(store.ErrMetaNotFound); ok && strings.HasPrefix(notFound.Resource, data.CanonicalRootRole+".") {

 			return nil, r.errRepositoryNotExist()

 		}

 		return nil, err

@@ -876,7 +777,7 @@ func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Cl

 	// try to read root from cache first. We will trust this root

 	// until we detect a problem during update which will cause

 	// us to download a new root and perform a rotation.

-	rootJSON, cachedRootErr := r.fileStore.GetMeta("root", maxSize)

+	rootJSON, cachedRootErr := r.fileStore.GetMeta("root", -1)

 	if cachedRootErr == nil {

 		signedRoot, cachedRootErr = r.validateRoot(rootJSON)

@@ -890,7 +791,8 @@ func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Cl

 		// checking for initialization of the repo).

 		// if remote store successfully set up, try and get root from remote

-		tmpJSON, err := remote.GetMeta("root", maxSize)

+		// We don't have any local data to determine the size of root, so try the maximum (though it is restricted at 100MB)

+		tmpJSON, err := remote.GetMeta("root", -1)

 		if err != nil {

 			// we didn't have a root in cache and were unable to load one from

 			// the server. Nothing we can do but error.

@@ -912,8 +814,7 @@ func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Cl

 		}

 	}

-	kdb := keys.NewDB()

-	r.tufRepo = tuf.NewRepo(kdb, r.CryptoService)

+	r.tufRepo = tuf.NewRepo(r.CryptoService)

 	if signedRoot == nil {

 		return nil, ErrRepoNotInitialized{}

@@ -927,7 +828,6 @@ func (r *NotaryRepository) bootstrapClient(checkInitialized bool) (*tufclient.Cl

 	return tufclient.NewClient(

 		r.tufRepo,

 		remote,

-		kdb,

 		r.fileStore,

 	), nil

 }

@@ -1020,7 +920,7 @@ func (r *NotaryRepository) DeleteTrustData() error {

 	if err := r.fileStore.RemoveAll(); err != nil {

 		return fmt.Errorf("error clearing TUF repo data: %v", err)

 	}

-	r.tufRepo = tuf.NewRepo(nil, nil)

+	r.tufRepo = tuf.NewRepo(nil)

 	// Clear certificates

 	certificates, err := r.CertStore.GetCertificatesByCN(r.gun)

 	if err != nil {

new file mode 100644

@@ -0,0 +1,294 @@

+package client

+

+import (

+	"encoding/json"

+	"fmt"

+	"path/filepath"

+

+	"github.com/Sirupsen/logrus"

+	"github.com/docker/notary"

+	"github.com/docker/notary/client/changelist"

+	"github.com/docker/notary/tuf/data"

+	"github.com/docker/notary/tuf/store"

+	"github.com/docker/notary/tuf/utils"

+)

+

+// AddDelegation creates changelist entries to add provided delegation public keys and paths.

+// This method composes AddDelegationRoleAndKeys and AddDelegationPaths (each creates one changelist if called).

+func (r *NotaryRepository) AddDelegation(name string, delegationKeys []data.PublicKey, paths []string) error {

+	if len(delegationKeys) > 0 {

+		err := r.AddDelegationRoleAndKeys(name, delegationKeys)

+		if err != nil {

+			return err

+		}

+	}

+	if len(paths) > 0 {

+		err := r.AddDelegationPaths(name, paths)

+		if err != nil {

+			return err

+		}

+	}

+	return nil

+}

+

+// AddDelegationRoleAndKeys creates a changelist entry to add provided delegation public keys.

+// This method is the simplest way to create a new delegation, because the delegation must have at least

+// one key upon creation to be valid since we will reject the changelist while validating the threshold.

+func (r *NotaryRepository) AddDelegationRoleAndKeys(name string, delegationKeys []data.PublicKey) error {

+

+	if !data.IsDelegation(name) {

+		return data.ErrInvalidRole{Role: name, Reason: "invalid delegation role name"}

+	}

+

+	cl, err := changelist.NewFileChangelist(filepath.Join(r.tufRepoPath, "changelist"))