@@ -38,6 +38,7 @@ import (

 	"github.com/docker/docker/pkg/sysinfo"

 	"github.com/docker/docker/pkg/truncindex"

 	"github.com/docker/docker/runconfig"

+	"github.com/docker/docker/trust"

 	"github.com/docker/docker/utils"

 	"github.com/docker/docker/volumes"

 )

@@ -98,6 +99,7 @@ type Daemon struct {

 	containerGraph *graphdb.Database

 	driver         graphdriver.Driver

 	execDriver     execdriver.Driver

+	trustStore     *trust.TrustStore

 }

 // Install installs daemon capabilities to eng.

@@ -136,6 +138,9 @@ func (daemon *Daemon) Install(eng *engine.Engine) error {

 	if err := daemon.Repositories().Install(eng); err != nil {

 		return err

 	}

+	if err := daemon.trustStore.Install(eng); err != nil {

+		return err

+	}

 	// FIXME: this hack is necessary for legacy integration tests to access

 	// the daemon object.

 	eng.Hack_SetGlobalVar("httpapi.daemon", daemon)

@@ -835,6 +840,15 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)

 		return nil, fmt.Errorf("Couldn't create Tag store: %s", err)

 	}

+	trustDir := path.Join(config.Root, "trust")

+	if err := os.MkdirAll(trustDir, 0700); err != nil && !os.IsExist(err) {

+		return nil, err

+	}

+	t, err := trust.NewTrustStore(trustDir)

+	if err != nil {

+		return nil, fmt.Errorf("could not create trust store: %s", err)

+	}

+

 	if !config.DisableNetwork {

 		job := eng.Job("init_networkdriver")

@@ -899,6 +913,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)

 		sysInitPath:    sysInitPath,

 		execDriver:     ed,

 		eng:            eng,

+		trustStore:     t,

 	}

 	if err := daemon.checkLocaldns(); err != nil {

 		return nil, err

@@ -1,10 +1,14 @@

 package graph

 import (

+	"bytes"

+	"encoding/json"

 	"fmt"

 	"io"

+	"io/ioutil"

 	"net"

 	"net/url"

+	"os"

 	"strings"

 	"time"

@@ -13,8 +17,60 @@ import (

 	"github.com/docker/docker/pkg/log"

 	"github.com/docker/docker/registry"

 	"github.com/docker/docker/utils"

+	"github.com/docker/libtrust"

 )

+func (s *TagStore) verifyManifest(eng *engine.Engine, manifestBytes []byte) (*registry.ManifestData, bool, error) {

+	sig, err := libtrust.ParsePrettySignature(manifestBytes, "signatures")

+	if err != nil {

+		return nil, false, fmt.Errorf("error parsing payload: %s", err)

+	}

+	keys, err := sig.Verify()

+	if err != nil {

+		return nil, false, fmt.Errorf("error verifying payload: %s", err)

+	}

+

+	payload, err := sig.Payload()

+	if err != nil {

+		return nil, false, fmt.Errorf("error retrieving payload: %s", err)

+	}

+

+	var manifest registry.ManifestData

+	if err := json.Unmarshal(payload, &manifest); err != nil {

+		return nil, false, fmt.Errorf("error unmarshalling manifest: %s", err)

+	}

+

+	var verified bool

+	for _, key := range keys {

+		job := eng.Job("trust_key_check")

+		b, err := key.MarshalJSON()

+		if err != nil {

+			return nil, false, fmt.Errorf("error marshalling public key: %s", err)

+		}

+		namespace := manifest.Name

+		if namespace[0] != '/' {

+			namespace = "/" + namespace

+		}

+		stdoutBuffer := bytes.NewBuffer(nil)

+

+		job.Args = append(job.Args, namespace)

+		job.Setenv("PublicKey", string(b))

+		// Check key has read/write permission (0x03)

+		job.SetenvInt("Permission", 0x03)

+		job.Stdout.Add(stdoutBuffer)

+		if err = job.Run(); err != nil {

+			return nil, false, fmt.Errorf("error running key check: %s", err)

+		}

+		result := engine.Tail(stdoutBuffer, 1)

+		log.Debugf("Key check result: %q", result)

+		if result == "verified" {

+			verified = true

+		}

+	}

+

+	return &manifest, verified, nil

+}

+

 func (s *TagStore) CmdPull(job *engine.Job) engine.Status {

 	if n := len(job.Args); n != 1 && n != 2 {

 		return job.Errorf("Usage: %s IMAGE [TAG]", job.Name)

@@ -52,7 +108,7 @@ func (s *TagStore) CmdPull(job *engine.Job) engine.Status {

 		return job.Error(err)

 	}

-	endpoint, err := registry.ExpandAndVerifyRegistryUrl(hostname)

+	endpoint, err := registry.NewEndpoint(hostname)

 	if err != nil {

 		return job.Error(err)

 	}

@@ -62,14 +118,32 @@ func (s *TagStore) CmdPull(job *engine.Job) engine.Status {

 		return job.Error(err)

 	}

-	if endpoint == registry.IndexServerAddress() {

+	var isOfficial bool

+	if endpoint.VersionString(1) == registry.IndexServerAddress() {

 		// If pull "index.docker.io/foo/bar", it's stored locally under "foo/bar"

 		localName = remoteName

+		isOfficial = isOfficialName(remoteName)

+		if isOfficial && strings.IndexRune(remoteName, '/') == -1 {

+			remoteName = "library/" + remoteName

+		}

+

 		// Use provided mirrors, if any

 		mirrors = s.mirrors

 	}

+	if isOfficial || endpoint.Version == registry.APIVersion2 {

+		j := job.Eng.Job("trust_update_base")

+		if err = j.Run(); err != nil {

+			return job.Errorf("error updating trust base graph: %s", err)

+		}

+

+		if err := s.pullV2Repository(job.Eng, r, job.Stdout, localName, remoteName, tag, sf, job.GetenvBool("parallel")); err == nil {

+			return engine.StatusOK

+		} else if err != registry.ErrDoesNotExist {

+			log.Errorf("Error from V2 registry: %s", err)

+		}

+	}

 	if err = s.pullRepository(r, job.Stdout, localName, remoteName, tag, sf, job.GetenvBool("parallel"), mirrors); err != nil {

 		return job.Error(err)

 	}

@@ -337,3 +411,169 @@ func WriteStatus(requestedTag string, out io.Writer, sf *utils.StreamFormatter,

 		out.Write(sf.FormatStatus("", "Status: Image is up to date for %s", requestedTag))

 	}

 }

+

+// downloadInfo is used to pass information from download to extractor

+type downloadInfo struct {

+	imgJSON    []byte

+	img        *image.Image

+	tmpFile    *os.File

+	length     int64

+	downloaded bool

+	err        chan error

+}

+

+func (s *TagStore) pullV2Repository(eng *engine.Engine, r *registry.Session, out io.Writer, localName, remoteName, tag string, sf *utils.StreamFormatter, parallel bool) error {

+	if tag == "" {

+		log.Debugf("Pulling tag list from V2 registry for %s", remoteName)

+		tags, err := r.GetV2RemoteTags(remoteName, nil)

+		if err != nil {

+			return err

+		}

+		for _, t := range tags {

+			if err := s.pullV2Tag(eng, r, out, localName, remoteName, t, sf, parallel); err != nil {

+				return err

+			}

+		}

+	} else {

+		if err := s.pullV2Tag(eng, r, out, localName, remoteName, tag, sf, parallel); err != nil {

+			return err

+		}

+	}

+

+	return nil

+}

+

+func (s *TagStore) pullV2Tag(eng *engine.Engine, r *registry.Session, out io.Writer, localName, remoteName, tag string, sf *utils.StreamFormatter, parallel bool) error {

+	log.Debugf("Pulling tag from V2 registry: %q", tag)

+	manifestBytes, err := r.GetV2ImageManifest(remoteName, tag, nil)

+	if err != nil {

+		return err

+	}

+

+	manifest, verified, err := s.verifyManifest(eng, manifestBytes)

+	if err != nil {

+		return fmt.Errorf("error verifying manifest: %s", err)

+	}

+

+	if len(manifest.BlobSums) != len(manifest.History) {

+		return fmt.Errorf("length of history not equal to number of layers")

+	}

+

+	if verified {

+		out.Write(sf.FormatStatus("", "The image you are pulling has been digitally signed by Docker, Inc."))

+	}

+	out.Write(sf.FormatStatus(tag, "Pulling from %s", localName))

+

+	downloads := make([]downloadInfo, len(manifest.BlobSums))

+

+	for i := len(manifest.BlobSums) - 1; i >= 0; i-- {

+		var (

+			sumStr  = manifest.BlobSums[i]

+			imgJSON = []byte(manifest.History[i])

+		)

+

+		img, err := image.NewImgJSON(imgJSON)

+		if err != nil {

+			return fmt.Errorf("failed to parse json: %s", err)

+		}

+		downloads[i].img = img

+

+		// Check if exists

+		if s.graph.Exists(img.ID) {

+			log.Debugf("Image already exists: %s", img.ID)

+			continue

+		}

+

+		chunks := strings.SplitN(sumStr, ":", 2)

+		if len(chunks) < 2 {

+			return fmt.Errorf("expected 2 parts in the sumStr, got %#v", chunks)

+		}

+		sumType, checksum := chunks[0], chunks[1]

+		out.Write(sf.FormatProgress(utils.TruncateID(img.ID), "Pulling fs layer", nil))

+

+		downloadFunc := func(di *downloadInfo) error {

+			log.Infof("pulling blob %q to V1 img %s", sumStr, img.ID)

+

+			if c, err := s.poolAdd("pull", "img:"+img.ID); err != nil {

+				if c != nil {

+					out.Write(sf.FormatProgress(utils.TruncateID(img.ID), "Layer already being pulled by another client. Waiting.", nil))

+					<-c

+					out.Write(sf.FormatProgress(utils.TruncateID(img.ID), "Download complete", nil))

+				} else {

+					log.Debugf("Image (id: %s) pull is already running, skipping: %v", img.ID, err)

+				}

+			} else {

+				tmpFile, err := ioutil.TempFile("", "GetV2ImageBlob")

+				if err != nil {

+					return err

+				}

+

+				r, l, err := r.GetV2ImageBlobReader(remoteName, sumType, checksum, nil)

+				if err != nil {

+					return err

+				}

+				defer r.Close()

+				io.Copy(tmpFile, utils.ProgressReader(r, int(l), out, sf, false, utils.TruncateID(img.ID), "Downloading"))

+

+				out.Write(sf.FormatProgress(utils.TruncateID(img.ID), "Download complete", nil))

+

+				log.Debugf("Downloaded %s to tempfile %s", img.ID, tmpFile.Name())

+				di.tmpFile = tmpFile

+				di.length = l

+				di.downloaded = true

+			}

+			di.imgJSON = imgJSON

+			defer s.poolRemove("pull", "img:"+img.ID)

+

+			return nil

+		}

+

+		if parallel {

+			downloads[i].err = make(chan error)

+			go func(di *downloadInfo) {

+				di.err <- downloadFunc(di)

+			}(&downloads[i])

+		} else {

+			err := downloadFunc(&downloads[i])

+			if err != nil {

+				return err

+			}

+		}

+	}

+

+	for i := len(downloads) - 1; i >= 0; i-- {

+		d := &downloads[i]

+		if d.err != nil {

+			err := <-d.err

+			if err != nil {

+				return err

+			}

+		}

+		if d.downloaded {

+			// if tmpFile is empty assume download and extracted elsewhere

+			defer os.Remove(d.tmpFile.Name())

+			defer d.tmpFile.Close()

+			d.tmpFile.Seek(0, 0)

+			if d.tmpFile != nil {

+				err = s.graph.Register(d.img, d.imgJSON,

+					utils.ProgressReader(d.tmpFile, int(d.length), out, sf, false, utils.TruncateID(d.img.ID), "Extracting"))

+				if err != nil {

+					return err

+				}

+

+				// FIXME: Pool release here for parallel tag pull (ensures any downloads block until fully extracted)

+			}

+			out.Write(sf.FormatProgress(utils.TruncateID(d.img.ID), "Pull complete", nil))

+

+		} else {

+			out.Write(sf.FormatProgress(utils.TruncateID(d.img.ID), "Already exists", nil))

+		}

+

+	}

+

+	if err = s.Set(localName, tag, downloads[0].img.ID, true); err != nil {

+		return err

+	}

+

+	return nil

+}

@@ -214,7 +214,7 @@ func (s *TagStore) CmdPush(job *engine.Job) engine.Status {

 		return job.Error(err)

 	}

-	endpoint, err := registry.ExpandAndVerifyRegistryUrl(hostname)

+	endpoint, err := registry.NewEndpoint(hostname)

 	if err != nil {

 		return job.Error(err)

 	}

@@ -243,7 +243,7 @@ func (s *TagStore) CmdPush(job *engine.Job) engine.Status {

 	var token []string

 	job.Stdout.Write(sf.FormatStatus("", "The push refers to an image: [%s]", localName))

-	if _, err := s.pushImage(r, job.Stdout, remoteName, img.ID, endpoint, token, sf); err != nil {

+	if _, err := s.pushImage(r, job.Stdout, remoteName, img.ID, endpoint.String(), token, sf); err != nil {

 		return job.Error(err)

 	}

 	return engine.StatusOK

@@ -276,6 +276,20 @@ func (store *TagStore) GetRepoRefs() map[string][]string {

 	return reporefs

 }

+// isOfficialName returns whether a repo name is considered an official

+// repository.  Official repositories are repos with names within

+// the library namespace or which default to the library namespace

+// by not providing one.

+func isOfficialName(name string) bool {

+	if strings.HasPrefix(name, "library/") {

+		return true

+	}

+	if strings.IndexRune(name, '/') == -1 {

+		return true

+	}

+	return false

+}

+

 // Validate the name of a repository

 func validateRepoName(name string) error {

 	if name == "" {

@@ -2,15 +2,16 @@ package graph

 import (

 	"bytes"

+	"io"

+	"os"

+	"path"

+	"testing"

+

 	"github.com/docker/docker/daemon/graphdriver"

 	_ "github.com/docker/docker/daemon/graphdriver/vfs" // import the vfs driver so it is used in the tests

 	"github.com/docker/docker/image"

 	"github.com/docker/docker/utils"

 	"github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar"

-	"io"

-	"os"

-	"path"

-	"testing"

 )

 const (

@@ -132,3 +133,18 @@ func TestInvalidTagName(t *testing.T) {

 		}

 	}

 }

+

+func TestOfficialName(t *testing.T) {

+	names := map[string]bool{

+		"library/ubuntu":    true,

+		"nonlibrary/ubuntu": false,

+		"ubuntu":            true,

+		"other/library":     false,

+	}

+	for name, isOfficial := range names {

+		result := isOfficialName(name)

+		if result != isOfficial {

+			t.Errorf("Unexpected result for %s\n\tExpecting: %v\n\tActual: %v", name, isOfficial, result)

+		}

+	}

+}

@@ -51,7 +51,7 @@ clone hg code.google.com/p/go.net 84a4013f96e0

 clone hg code.google.com/p/gosqlite 74691fb6f837

-clone git github.com/docker/libtrust 136d534cc940

+clone git github.com/docker/libtrust d273ef2565ca

 # get Go tip's archive/tar, for xattr support and improved performance

 # TODO after Go 1.4 drops, bump our minimum supported version and drop this vendored dep

new file mode 100644

@@ -0,0 +1,129 @@

+package registry

+

+import (

+	"encoding/json"

+	"errors"

+	"fmt"

+	"io/ioutil"

+	"net/http"

+	"net/url"

+	"strings"

+

+	"github.com/docker/docker/pkg/log"

+)

+

+// scans string for api version in the URL path. returns the trimmed hostname, if version found, string and API version.

+func scanForApiVersion(hostname string) (string, APIVersion) {

+	var (

+		chunks        []string

+		apiVersionStr string

+	)

+	if strings.HasSuffix(hostname, "/") {

+		chunks = strings.Split(hostname[:len(hostname)-1], "/")

+		apiVersionStr = chunks[len(chunks)-1]

+	} else {

+		chunks = strings.Split(hostname, "/")

+		apiVersionStr = chunks[len(chunks)-1]

+	}

+	for k, v := range apiVersions {

+		if apiVersionStr == v {

+			hostname = strings.Join(chunks[:len(chunks)-1], "/")

+			return hostname, k

+		}

+	}

+	return hostname, DefaultAPIVersion

+}

+

+func NewEndpoint(hostname string) (*Endpoint, error) {

+	var (

+		endpoint        Endpoint

+		trimmedHostname string

+		err             error

+	)

+	if !strings.HasPrefix(hostname, "http") {

+		hostname = "https://" + hostname

+	}

+	trimmedHostname, endpoint.Version = scanForApiVersion(hostname)

+	endpoint.URL, err = url.Parse(trimmedHostname)

+	if err != nil {

+		return nil, err

+	}

+

+	endpoint.URL.Scheme = "https"

+	if _, err := endpoint.Ping(); err != nil {

+		log.Debugf("Registry %s does not work (%s), falling back to http", endpoint, err)

+		// TODO: Check if http fallback is enabled

+		endpoint.URL.Scheme = "http"

+		if _, err = endpoint.Ping(); err != nil {

+			return nil, errors.New("Invalid Registry endpoint: " + err.Error())

+		}

+	}

+

+	return &endpoint, nil

+}

+

+type Endpoint struct {

+	URL     *url.URL

+	Version APIVersion

+}

+

+// Get the formated URL for the root of this registry Endpoint

+func (e Endpoint) String() string {

+	return fmt.Sprintf("%s/v%d/", e.URL.String(), e.Version)

+}

+

+func (e Endpoint) VersionString(version APIVersion) string {

+	return fmt.Sprintf("%s/v%d/", e.URL.String(), version)

+}

+

+func (e Endpoint) Ping() (RegistryInfo, error) {

+	if e.String() == IndexServerAddress() {

+		// Skip the check, we now this one is valid

+		// (and we never want to fallback to http in case of error)

+		return RegistryInfo{Standalone: false}, nil

+	}

+

+	req, err := http.NewRequest("GET", e.String()+"_ping", nil)

+	if err != nil {

+		return RegistryInfo{Standalone: false}, err

+	}

+

+	resp, _, err := doRequest(req, nil, ConnectTimeout)

+	if err != nil {

+		return RegistryInfo{Standalone: false}, err

+	}

+

+	defer resp.Body.Close()

+

+	jsonString, err := ioutil.ReadAll(resp.Body)

+	if err != nil {

+		return RegistryInfo{Standalone: false}, fmt.Errorf("Error while reading the http response: %s", err)

+	}

+

+	// If the header is absent, we assume true for compatibility with earlier

+	// versions of the registry. default to true

+	info := RegistryInfo{

+		Standalone: true,

+	}

+	if err := json.Unmarshal(jsonString, &info); err != nil {

+		log.Debugf("Error unmarshalling the _ping RegistryInfo: %s", err)

+		// don't stop here. Just assume sane defaults

+	}

+	if hdr := resp.Header.Get("X-Docker-Registry-Version"); hdr != "" {

+		log.Debugf("Registry version header: '%s'", hdr)

+		info.Version = hdr

+	}

+	log.Debugf("RegistryInfo.Version: %q", info.Version)

+

+	standalone := resp.Header.Get("X-Docker-Registry-Standalone")

+	log.Debugf("Registry standalone header: '%s'", standalone)

+	// Accepted values are "true" (case-insensitive) and "1".

+	if strings.EqualFold(standalone, "true") || standalone == "1" {

+		info.Standalone = true

+	} else if len(standalone) > 0 {

+		// there is a header set, and it is not "true" or "1", so assume fails

+		info.Standalone = false

+	}

+	log.Debugf("RegistryInfo.Standalone: %t", info.Standalone)

+	return info, nil

+}

@@ -3,7 +3,6 @@ package registry

 import (

 	"crypto/tls"

 	"crypto/x509"

-	"encoding/json"

 	"errors"

 	"fmt"

 	"io/ioutil"

@@ -15,13 +14,13 @@ import (

 	"strings"

 	"time"

-	"github.com/docker/docker/pkg/log"

 	"github.com/docker/docker/utils"

 )

 var (

 	ErrAlreadyExists         = errors.New("Image already exists")

 	ErrInvalidRepositoryName = errors.New("Invalid repository name (ex: \"registry.domain.tld/myrepos\")")

+	ErrDoesNotExist          = errors.New("Image does not exist")

 	errLoginRequired         = errors.New("Authentication is required.")

 	validHex                 = regexp.MustCompile(`^([a-f0-9]{64})$`)

 	validNamespace           = regexp.MustCompile(`^([a-z0-9_]{4,30})$`)

@@ -152,55 +151,6 @@ func doRequest(req *http.Request, jar http.CookieJar, timeout TimeoutType) (*htt

 	return nil, nil, nil

 }

-func pingRegistryEndpoint(endpoint string) (RegistryInfo, error) {

-	if endpoint == IndexServerAddress() {

-		// Skip the check, we now this one is valid

-		// (and we never want to fallback to http in case of error)

-		return RegistryInfo{Standalone: false}, nil

-	}

-

-	req, err := http.NewRequest("GET", endpoint+"_ping", nil)

-	if err != nil {

-		return RegistryInfo{Standalone: false}, err

-	}

-

-	resp, _, err := doRequest(req, nil, ConnectTimeout)

-	if err != nil {

-		return RegistryInfo{Standalone: false}, err

-	}

-

-	defer resp.Body.Close()

-

-	jsonString, err := ioutil.ReadAll(resp.Body)

-	if err != nil {

-		return RegistryInfo{Standalone: false}, fmt.Errorf("Error while reading the http response: %s", err)

-	}

-

-	// If the header is absent, we assume true for compatibility with earlier

-	// versions of the registry. default to true

-	info := RegistryInfo{

-		Standalone: true,

-	}

-	if err := json.Unmarshal(jsonString, &info); err != nil {

-		log.Debugf("Error unmarshalling the _ping RegistryInfo: %s", err)

-		// don't stop here. Just assume sane defaults

-	}

-	if hdr := resp.Header.Get("X-Docker-Registry-Version"); hdr != "" {

-		log.Debugf("Registry version header: '%s'", hdr)

-		info.Version = hdr

-	}

-	log.Debugf("RegistryInfo.Version: %q", info.Version)

-

-	standalone := resp.Header.Get("X-Docker-Registry-Standalone")

-	log.Debugf("Registry standalone header: '%s'", standalone)

-	if !strings.EqualFold(standalone, "true") && standalone != "1" && len(standalone) > 0 {

-		// there is a header set, and it is not "true" or "1", so assume fails

-		info.Standalone = false

-	}

-	log.Debugf("RegistryInfo.Standalone: %q", info.Standalone)

-	return info, nil

-}

-

 func validateRepositoryName(repositoryName string) error {

 	var (

 		namespace string

@@ -252,33 +202,6 @@ func ResolveRepositoryName(reposName string) (string, string, error) {

 	return hostname, reposName, nil

 }

-// this method expands the registry name as used in the prefix of a repo

-// to a full url. if it already is a url, there will be no change.

-// The registry is pinged to test if it http or https

-func ExpandAndVerifyRegistryUrl(hostname string) (string, error) {

-	if strings.HasPrefix(hostname, "http:") || strings.HasPrefix(hostname, "https:") {

-		// if there is no slash after https:// (8 characters) then we have no path in the url

-		if strings.LastIndex(hostname, "/") < 9 {

-			// there is no path given. Expand with default path

-			hostname = hostname + "/v1/"

-		}

-		if _, err := pingRegistryEndpoint(hostname); err != nil {

-			return "", errors.New("Invalid Registry endpoint: " + err.Error())

-		}

-		return hostname, nil

-	}

-	endpoint := fmt.Sprintf("https://%s/v1/", hostname)

-	if _, err := pingRegistryEndpoint(endpoint); err != nil {

-		log.Debugf("Registry %s does not work (%s), falling back to http", endpoint, err)

-		endpoint = fmt.Sprintf("http://%s/v1/", hostname)

-		if _, err = pingRegistryEndpoint(endpoint); err != nil {

-			//TODO: triggering highland build can be done there without "failing"

-			return "", errors.New("Invalid Registry endpoint: " + err.Error())

-		}

-	}

-	return endpoint, nil

-}

-

 func trustedLocation(req *http.Request) bool {

 	var (

 		trusteds = []string{"docker.com", "docker.io"}

@@ -83,6 +83,8 @@ var (

 func init() {

 	r := mux.NewRouter()

+

+	// /v1/

 	r.HandleFunc("/v1/_ping", handlerGetPing).Methods("GET")

 	r.HandleFunc("/v1/images/{image_id:[^/]+}/{action:json|layer|ancestry}", handlerGetImage).Methods("GET")

 	r.HandleFunc("/v1/images/{image_id:[^/]+}/{action:json|layer|checksum}", handlerPutImage).Methods("PUT")

@@ -93,6 +95,10 @@ func init() {

 	r.HandleFunc("/v1/repositories/{repository:.+}{action:/images|/}", handlerImages).Methods("GET", "PUT", "DELETE")

 	r.HandleFunc("/v1/repositories/{repository:.+}/auth", handlerAuth).Methods("PUT")

 	r.HandleFunc("/v1/search", handlerSearch).Methods("GET")

+

+	// /v2/

+	r.HandleFunc("/v2/version", handlerGetPing).Methods("GET")

+

 	testHttpServer = httptest.NewServer(handlerAccessLog(r))

 }

@@ -18,7 +18,11 @@ var (

 func spawnTestRegistrySession(t *testing.T) *Session {

 	authConfig := &AuthConfig{}

-	r, err := NewSession(authConfig, utils.NewHTTPRequestFactory(), makeURL("/v1/"), true)

+	endpoint, err := NewEndpoint(makeURL("/v1/"))

+	if err != nil {

+		t.Fatal(err)

+	}

+	r, err := NewSession(authConfig, utils.NewHTTPRequestFactory(), endpoint, true)

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -26,7 +30,11 @@ func spawnTestRegistrySession(t *testing.T) *Session {

 }

 func TestPingRegistryEndpoint(t *testing.T) {

-	regInfo, err := pingRegistryEndpoint(makeURL("/v1/"))

+	ep, err := NewEndpoint(makeURL("/v1/"))

+	if err != nil {

+		t.Fatal(err)

+	}

+	regInfo, err := ep.Ping()

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -197,7 +205,7 @@ func TestPushImageJSONIndex(t *testing.T) {

 	if repoData == nil {

 		t.Fatal("Expected RepositoryData object")

 	}

-	repoData, err = r.PushImageJSONIndex("foo42/bar", imgData, true, []string{r.indexEndpoint})

+	repoData, err = r.PushImageJSONIndex("foo42/bar", imgData, true, []string{r.indexEndpoint.String()})

 	if err != nil {

 		t.Fatal(err)

 	}

@@ -40,11 +40,14 @@ func (s *Service) Auth(job *engine.Job) engine.Status {

 	job.GetenvJson("authConfig", authConfig)

 	// TODO: this is only done here because auth and registry need to be merged into one pkg

 	if addr := authConfig.ServerAddress; addr != "" && addr != IndexServerAddress() {

-		addr, err = ExpandAndVerifyRegistryUrl(addr)

+		endpoint, err := NewEndpoint(addr)

 		if err != nil {

 			return job.Error(err)

 		}

-		authConfig.ServerAddress = addr

+		if _, err := endpoint.Ping(); err != nil {

+			return job.Error(err)

+		}

+		authConfig.ServerAddress = endpoint.String()

 	}

 	status, err := Login(authConfig, HTTPRequestFactory(nil))

 	if err != nil {

@@ -86,11 +89,11 @@ func (s *Service) Search(job *engine.Job) engine.Status {

 	if err != nil {

 		return job.Error(err)

 	}

-	hostname, err = ExpandAndVerifyRegistryUrl(hostname)

+	endpoint, err := NewEndpoint(hostname)

 	if err != nil {

 		return job.Error(err)

 	}

-	r, err := NewSession(authConfig, HTTPRequestFactory(metaHeaders), hostname, true)

+	r, err := NewSession(authConfig, HTTPRequestFactory(metaHeaders), endpoint, true)

 	if err != nil {

 		return job.Error(err)

 	}

@@ -25,15 +25,15 @@ import (

 type Session struct {

 	authConfig    *AuthConfig

 	reqFactory    *utils.HTTPRequestFactory

-	indexEndpoint string

+	indexEndpoint *Endpoint

 	jar           *cookiejar.Jar

 	timeout       TimeoutType

 }

-func NewSession(authConfig *AuthConfig, factory *utils.HTTPRequestFactory, indexEndpoint string, timeout bool) (r *Session, err error) {

+func NewSession(authConfig *AuthConfig, factory *utils.HTTPRequestFactory, endpoint *Endpoint, timeout bool) (r *Session, err error) {

 	r = &Session{

 		authConfig:    authConfig,

-		indexEndpoint: indexEndpoint,

+		indexEndpoint: endpoint,

 	}

 	if timeout {

@@ -47,13 +47,13 @@ func NewSession(authConfig *AuthConfig, factory *utils.HTTPRequestFactory, index

 	// If we're working with a standalone private registry over HTTPS, send Basic Auth headers

 	// alongside our requests.

-	if indexEndpoint != IndexServerAddress() && strings.HasPrefix(indexEndpoint, "https://") {

-		info, err := pingRegistryEndpoint(indexEndpoint)

+	if r.indexEndpoint.VersionString(1) != IndexServerAddress() && r.indexEndpoint.URL.Scheme == "https" {

+		info, err := r.indexEndpoint.Ping()

 		if err != nil {

 			return nil, err

 		}

 		if info.Standalone {

-			log.Debugf("Endpoint %s is eligible for private registry registry. Enabling decorator.", indexEndpoint)

+			log.Debugf("Endpoint %s is eligible for private registry registry. Enabling decorator.", r.indexEndpoint.String())

 			dec := utils.NewHTTPAuthDecorator(authConfig.Username, authConfig.Password)

 			factory.AddDecorator(dec)

 		}

@@ -261,8 +261,7 @@ func buildEndpointsList(headers []string, indexEp string) ([]string, error) {

 }

 func (r *Session) GetRepositoryData(remote string) (*RepositoryData, error) {

-	indexEp := r.indexEndpoint

-	repositoryTarget := fmt.Sprintf("%srepositories/%s/images", indexEp, remote)

+	repositoryTarget := fmt.Sprintf("%srepositories/%s/images", r.indexEndpoint.VersionString(1), remote)

 	log.Debugf("[registry] Calling GET %s", repositoryTarget)

@@ -296,17 +295,13 @@ func (r *Session) GetRepositoryData(remote string) (*RepositoryData, error) {

 	var endpoints []string

 	if res.Header.Get("X-Docker-Endpoints") != "" {

-		endpoints, err = buildEndpointsList(res.Header["X-Docker-Endpoints"], indexEp)

+		endpoints, err = buildEndpointsList(res.Header["X-Docker-Endpoints"], r.indexEndpoint.VersionString(1))

 		if err != nil {

 			return nil, err

 		}

 	} else {

 		// Assume the endpoint is on the same host

-		u, err := url.Parse(indexEp)

-		if err != nil {

-			return nil, err

-		}

-		endpoints = append(endpoints, fmt.Sprintf("%s://%s/v1/", u.Scheme, req.URL.Host))

+		endpoints = append(endpoints, fmt.Sprintf("%s://%s/v1/", r.indexEndpoint.URL.Scheme, req.URL.Host))

 	}

 	checksumsJSON, err := ioutil.ReadAll(res.Body)

@@ -474,7 +469,6 @@ func (r *Session) PushRegistryTag(remote, revision, tag, registry string, token

 func (r *Session) PushImageJSONIndex(remote string, imgList []*ImgData, validate bool, regs []string) (*RepositoryData, error) {

 	cleanImgList := []*ImgData{}

-	indexEp := r.indexEndpoint

 	if validate {

 		for _, elem := range imgList {

@@ -494,7 +488,7 @@ func (r *Session) PushImageJSONIndex(remote string, imgList []*ImgData, validate

 	if validate {

 		suffix = "images"

 	}

-	u := fmt.Sprintf("%srepositories/%s/%s", indexEp, remote, suffix)

+	u := fmt.Sprintf("%srepositories/%s/%s", r.indexEndpoint.VersionString(1), remote, suffix)

 	log.Debugf("[registry] PUT %s", u)

 	log.Debugf("Image list pushed to index:\n%s", imgListJSON)

 	req, err := r.reqFactory.NewRequest("PUT", u, bytes.NewReader(imgListJSON))

@@ -552,7 +546,7 @@ func (r *Session) PushImageJSONIndex(remote string, imgList []*ImgData, validate

 		}

 		if res.Header.Get("X-Docker-Endpoints") != "" {

-			endpoints, err = buildEndpointsList(res.Header["X-Docker-Endpoints"], indexEp)

+			endpoints, err = buildEndpointsList(res.Header["X-Docker-Endpoints"], r.indexEndpoint.VersionString(1))

 			if err != nil {

 				return nil, err

 			}

@@ -578,7 +572,7 @@ func (r *Session) PushImageJSONIndex(remote string, imgList []*ImgData, validate

 func (r *Session) SearchRepositories(term string) (*SearchResults, error) {

 	log.Debugf("Index server: %s", r.indexEndpoint)

-	u := r.indexEndpoint + "search?q=" + url.QueryEscape(term)

+	u := r.indexEndpoint.VersionString(1) + "search?q=" + url.QueryEscape(term)

 	req, err := r.reqFactory.NewRequest("GET", u, nil)

 	if err != nil {

 		return nil, err

new file mode 100644

@@ -0,0 +1,386 @@

+package registry

+

+import (

+	"encoding/json"

+	"fmt"

+	"io"

+	"io/ioutil"

+	"net/url"

+	"strconv"

+

+	"github.com/docker/docker/pkg/log"

+	"github.com/docker/docker/utils"