@@ -147,14 +147,21 @@ RUN set -x \

 	) \

 	&& rm -rf "$SECCOMP_PATH"

-# Install registry

-ENV REGISTRY_COMMIT ec87e9b6971d831f0eff752ddb54fb64693e51cd

+# Install two versions of the registry. The first is an older version that

+# only supports schema1 manifests. The second is a newer version that supports

+# both. This allows integration-cli tests to cover push/pull with both schema1

+# and schema2 manifests.

+ENV REGISTRY_COMMIT_SCHEMA1 ec87e9b6971d831f0eff752ddb54fb64693e51cd

+ENV REGISTRY_COMMIT a7ae88da459b98b481a245e5b1750134724ac67d

 RUN set -x \

 	&& export GOPATH="$(mktemp -d)" \

 	&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \

 	&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \

 	&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \

 		go build -o /usr/local/bin/registry-v2 github.com/docker/distribution/cmd/registry \

+	&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1") \

+	&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \

+		go build -o /usr/local/bin/registry-v2-schema1 github.com/docker/distribution/cmd/registry \

 	&& rm -rf "$GOPATH"

 # Install notary server

@@ -12,8 +12,11 @@ import (

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/digest"

+	"github.com/docker/distribution/manifest/manifestlist"

 	"github.com/docker/distribution/manifest/schema1"

+	"github.com/docker/distribution/manifest/schema2"

 	"github.com/docker/distribution/registry/api/errcode"

+	"github.com/docker/distribution/registry/client"

 	"github.com/docker/docker/distribution/metadata"

 	"github.com/docker/docker/distribution/xfer"

 	"github.com/docker/docker/image"

@@ -27,6 +30,8 @@ import (

 	"golang.org/x/net/context"

 )

+var errRootFSMismatch = errors.New("layers from manifest don't match image configuration")

+

 type v2Puller struct {

 	blobSumService *metadata.BlobSumService

 	endpoint       registry.APIEndpoint

@@ -61,18 +66,12 @@ func (p *v2Puller) Pull(ctx context.Context, ref reference.Named) (err error) {

 func (p *v2Puller) pullV2Repository(ctx context.Context, ref reference.Named) (err error) {

 	var layersDownloaded bool

 	if !reference.IsNameOnly(ref) {

-		var err error

 		layersDownloaded, err = p.pullV2Tag(ctx, ref)

 		if err != nil {

 			return err

 		}

 	} else {

-		manSvc, err := p.repo.Manifests(ctx)

-		if err != nil {

-			return err

-		}

-

-		tags, err := manSvc.Tags()

+		tags, err := p.repo.Tags(ctx).All(ctx)

 		if err != nil {

 			// If this repository doesn't exist on V2, we should

 			// permit a fallback to V1.

@@ -84,8 +83,6 @@ func (p *v2Puller) pullV2Repository(ctx context.Context, ref reference.Named) (e

 		// error later on.

 		p.confirmedV2 = true

-		// This probably becomes a lot nicer after the manifest

-		// refactor...

 		for _, tag := range tags {

 			tagRef, err := reference.WithTag(ref, tag)

 			if err != nil {

@@ -203,58 +200,111 @@ func (ld *v2LayerDescriptor) Registered(diffID layer.DiffID) {

 }

 func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdated bool, err error) {

-	tagOrDigest := ""

+	manSvc, err := p.repo.Manifests(ctx)

+	if err != nil {

+		return false, err

+	}

+

+	var (

+		manifest    distribution.Manifest

+		tagOrDigest string // Used for logging/progress only

+	)

 	if tagged, isTagged := ref.(reference.NamedTagged); isTagged {

+		// NOTE: not using TagService.Get, since it uses HEAD requests

+		// against the manifests endpoint, which are not supported by

+		// all registry versions.

+		manifest, err = manSvc.Get(ctx, "", client.WithTag(tagged.Tag()))

+		if err != nil {

+			return false, allowV1Fallback(err)

+		}

 		tagOrDigest = tagged.Tag()

-	} else if digested, isCanonical := ref.(reference.Canonical); isCanonical {

+	} else if digested, isDigested := ref.(reference.Canonical); isDigested {

+		manifest, err = manSvc.Get(ctx, digested.Digest())

+		if err != nil {

+			return false, err

+		}

 		tagOrDigest = digested.Digest().String()

 	} else {

 		return false, fmt.Errorf("internal error: reference has neither a tag nor a digest: %s", ref.String())

 	}

-	logrus.Debugf("Pulling ref from V2 registry: %s:%s", ref.FullName(), tagOrDigest)

+	if manifest == nil {

+		return false, fmt.Errorf("image manifest does not exist for tag or digest %q", tagOrDigest)

+	}

-	manSvc, err := p.repo.Manifests(ctx)

-	if err != nil {

-		return false, err

+	// If manSvc.Get succeeded, we can be confident that the registry on

+	// the other side speaks the v2 protocol.

+	p.confirmedV2 = true

+

+	logrus.Debugf("Pulling ref from V2 registry: %s", ref.String())

+	progress.Message(p.config.ProgressOutput, tagOrDigest, "Pulling from "+p.repo.Name())

+

+	var (

+		imageID        image.ID

+		manifestDigest digest.Digest

+	)

+

+	switch v := manifest.(type) {

+	case *schema1.SignedManifest:

+		imageID, manifestDigest, err = p.pullSchema1(ctx, ref, v)

+		if err != nil {

+			return false, err

+		}

+	case *schema2.DeserializedManifest:

+		imageID, manifestDigest, err = p.pullSchema2(ctx, ref, v)

+		if err != nil {

+			return false, err

+		}

+	case *manifestlist.DeserializedManifestList:

+		imageID, manifestDigest, err = p.pullManifestList(ctx, ref, v)

+		if err != nil {

+			return false, err

+		}

+	default:

+		return false, errors.New("unsupported manifest format")

 	}

-	unverifiedManifest, err := manSvc.GetByTag(tagOrDigest)

-	if err != nil {

-		// If this manifest did not exist, we should allow a possible

-		// fallback to the v1 protocol, because dual-version setups may

-		// not host all manifests with the v2 protocol. We may also get

-		// a "not authorized" error if the manifest doesn't exist.

-		return false, allowV1Fallback(err)

+	progress.Message(p.config.ProgressOutput, "", "Digest: "+manifestDigest.String())

+

+	oldTagImageID, err := p.config.ReferenceStore.Get(ref)

+	if err == nil {

+		if oldTagImageID == imageID {

+			return false, nil

+		}

+	} else if err != reference.ErrDoesNotExist {

+		return false, err

 	}

-	if unverifiedManifest == nil {

-		return false, fmt.Errorf("image manifest does not exist for tag or digest %q", tagOrDigest)

+

+	if canonical, ok := ref.(reference.Canonical); ok {

+		if err = p.config.ReferenceStore.AddDigest(canonical, imageID, true); err != nil {

+			return false, err

+		}

+	} else if err = p.config.ReferenceStore.AddTag(ref, imageID, true); err != nil {

+		return false, err

 	}

-	// If GetByTag succeeded, we can be confident that the registry on

-	// the other side speaks the v2 protocol.

-	p.confirmedV2 = true

+	return true, nil

+}

+func (p *v2Puller) pullSchema1(ctx context.Context, ref reference.Named, unverifiedManifest *schema1.SignedManifest) (imageID image.ID, manifestDigest digest.Digest, err error) {

 	var verifiedManifest *schema1.Manifest

-	verifiedManifest, err = verifyManifest(unverifiedManifest, ref)

+	verifiedManifest, err = verifySchema1Manifest(unverifiedManifest, ref)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

 	rootFS := image.NewRootFS()

 	if err := detectBaseLayer(p.config.ImageStore, verifiedManifest, rootFS); err != nil {

-		return false, err

+		return "", "", err

 	}

 	// remove duplicate layers and check parent chain validity

 	err = fixManifestLayers(verifiedManifest)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

-	progress.Message(p.config.ProgressOutput, tagOrDigest, "Pulling from "+p.repo.Name())

-

 	var descriptors []xfer.DownloadDescriptor

 	// Image history converted to the new format

@@ -269,12 +319,12 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat

 			ThrowAway bool `json:"throwaway,omitempty"`

 		}

 		if err := json.Unmarshal([]byte(verifiedManifest.History[i].V1Compatibility), &throwAway); err != nil {

-			return false, err

+			return "", "", err

 		}

 		h, err := v1.HistoryFromConfig([]byte(verifiedManifest.History[i].V1Compatibility), throwAway.ThrowAway)

 		if err != nil {

-			return false, err

+			return "", "", err

 		}

 		history = append(history, h)

@@ -293,43 +343,257 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat

 	resultRootFS, release, err := p.config.DownloadManager.Download(ctx, *rootFS, descriptors, p.config.ProgressOutput)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

 	defer release()

 	config, err := v1.MakeConfigFromV1Config([]byte(verifiedManifest.History[0].V1Compatibility), &resultRootFS, history)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

-	imageID, err := p.config.ImageStore.Create(config)

+	imageID, err = p.config.ImageStore.Create(config)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

-	manifestDigest, _, err := digestFromManifest(unverifiedManifest, p.repoInfo)

+	manifestDigest = digest.FromBytes(unverifiedManifest.Canonical)

+

+	return imageID, manifestDigest, nil

+}

+

+func (p *v2Puller) pullSchema2(ctx context.Context, ref reference.Named, mfst *schema2.DeserializedManifest) (imageID image.ID, manifestDigest digest.Digest, err error) {

+	manifestDigest, err = schema2ManifestDigest(ref, mfst)

 	if err != nil {

-		return false, err

+		return "", "", err

 	}

-	if manifestDigest != "" {

-		progress.Message(p.config.ProgressOutput, "", "Digest: "+manifestDigest.String())

+	target := mfst.Target()

+	imageID = image.ID(target.Digest)

+	if _, err := p.config.ImageStore.Get(imageID); err == nil {

+		// If the image already exists locally, no need to pull

+		// anything.

+		return imageID, manifestDigest, nil

 	}

-	oldTagImageID, err := p.config.ReferenceStore.Get(ref)

-	if err == nil && oldTagImageID == imageID {

-		return false, nil

+	configChan := make(chan []byte, 1)

+	errChan := make(chan error, 1)

+	var cancel func()

+	ctx, cancel = context.WithCancel(ctx)

+

+	// Pull the image config

+	go func() {

+		configJSON, err := p.pullSchema2ImageConfig(ctx, target.Digest)

+		if err != nil {

+			errChan <- err

+			cancel()

+			return

+		}

+		configChan <- configJSON

+	}()

+

+	var descriptors []xfer.DownloadDescriptor

+

+	// Note that the order of this loop is in the direction of bottom-most

+	// to top-most, so that the downloads slice gets ordered correctly.

+	for _, d := range mfst.References() {

+		layerDescriptor := &v2LayerDescriptor{

+			digest:         d.Digest,

+			repo:           p.repo,

+			blobSumService: p.blobSumService,

+		}

+

+		descriptors = append(descriptors, layerDescriptor)

 	}

-	if canonical, ok := ref.(reference.Canonical); ok {

-		if err = p.config.ReferenceStore.AddDigest(canonical, imageID, true); err != nil {

-			return false, err

+	var (

+		configJSON         []byte       // raw serialized image config

+		unmarshalledConfig image.Image  // deserialized image config

+		downloadRootFS     image.RootFS // rootFS to use for registering layers.

+	)

+	if runtime.GOOS == "windows" {

+		configJSON, unmarshalledConfig, err = receiveConfig(configChan, errChan)

+		if err != nil {

+			return "", "", err

 		}

-	} else if err = p.config.ReferenceStore.AddTag(ref, imageID, true); err != nil {

-		return false, err

+		if unmarshalledConfig.RootFS == nil {

+			return "", "", errors.New("image config has no rootfs section")

+		}

+		downloadRootFS = *unmarshalledConfig.RootFS

+		downloadRootFS.DiffIDs = []layer.DiffID{}

+	} else {

+		downloadRootFS = *image.NewRootFS()

 	}

-	return true, nil

+	rootFS, release, err := p.config.DownloadManager.Download(ctx, downloadRootFS, descriptors, p.config.ProgressOutput)

+	if err != nil {

+		if configJSON != nil {

+			// Already received the config

+			return "", "", err

+		}

+		select {

+		case err = <-errChan:

+			return "", "", err

+		default:

+			cancel()

+			select {

+			case <-configChan:

+			case <-errChan:

+			}

+			return "", "", err

+		}

+	}

+	defer release()

+

+	if configJSON == nil {

+		configJSON, unmarshalledConfig, err = receiveConfig(configChan, errChan)

+		if err != nil {

+			return "", "", err

+		}

+	}

+

+	// The DiffIDs returned in rootFS MUST match those in the config.

+	// Otherwise the image config could be referencing layers that aren't

+	// included in the manifest.

+	if len(rootFS.DiffIDs) != len(unmarshalledConfig.RootFS.DiffIDs) {

+		return "", "", errRootFSMismatch

+	}

+

+	for i := range rootFS.DiffIDs {

+		if rootFS.DiffIDs[i] != unmarshalledConfig.RootFS.DiffIDs[i] {

+			return "", "", errRootFSMismatch

+		}

+	}

+

+	imageID, err = p.config.ImageStore.Create(configJSON)

+	if err != nil {

+		return "", "", err

+	}

+

+	return imageID, manifestDigest, nil

+}

+

+func receiveConfig(configChan <-chan []byte, errChan <-chan error) ([]byte, image.Image, error) {

+	select {

+	case configJSON := <-configChan:

+		var unmarshalledConfig image.Image

+		if err := json.Unmarshal(configJSON, &unmarshalledConfig); err != nil {

+			return nil, image.Image{}, err

+		}

+		return configJSON, unmarshalledConfig, nil

+	case err := <-errChan:

+		return nil, image.Image{}, err

+		// Don't need a case for ctx.Done in the select because cancellation

+		// will trigger an error in p.pullSchema2ImageConfig.

+	}

+}

+

+// pullManifestList handles "manifest lists" which point to various

+// platform-specifc manifests.

+func (p *v2Puller) pullManifestList(ctx context.Context, ref reference.Named, mfstList *manifestlist.DeserializedManifestList) (imageID image.ID, manifestListDigest digest.Digest, err error) {

+	manifestListDigest, err = schema2ManifestDigest(ref, mfstList)

+	if err != nil {

+		return "", "", err

+	}

+

+	var manifestDigest digest.Digest

+	for _, manifestDescriptor := range mfstList.Manifests {

+		// TODO(aaronl): The manifest list spec supports optional

+		// "features" and "variant" fields. These are not yet used.

+		// Once they are, their values should be interpreted here.

+		if manifestDescriptor.Platform.Architecture == runtime.GOARCH && manifestDescriptor.Platform.OS == runtime.GOOS {

+			manifestDigest = manifestDescriptor.Digest

+			break

+		}

+	}

+

+	if manifestDigest == "" {

+		return "", "", errors.New("no supported platform found in manifest list")

+	}

+

+	manSvc, err := p.repo.Manifests(ctx)

+	if err != nil {

+		return "", "", err

+	}

+

+	manifest, err := manSvc.Get(ctx, manifestDigest)

+	if err != nil {

+		return "", "", err

+	}

+

+	manifestRef, err := reference.WithDigest(ref, manifestDigest)

+	if err != nil {

+		return "", "", err

+	}

+

+	switch v := manifest.(type) {

+	case *schema1.SignedManifest:

+		imageID, _, err = p.pullSchema1(ctx, manifestRef, v)

+		if err != nil {

+			return "", "", err

+		}

+	case *schema2.DeserializedManifest:

+		imageID, _, err = p.pullSchema2(ctx, manifestRef, v)

+		if err != nil {

+			return "", "", err

+		}

+	default:

+		return "", "", errors.New("unsupported manifest format")

+	}

+

+	return imageID, manifestListDigest, err

+}

+

+func (p *v2Puller) pullSchema2ImageConfig(ctx context.Context, dgst digest.Digest) (configJSON []byte, err error) {

+	blobs := p.repo.Blobs(ctx)

+	configJSON, err = blobs.Get(ctx, dgst)

+	if err != nil {

+		return nil, err

+	}

+

+	// Verify image config digest

+	verifier, err := digest.NewDigestVerifier(dgst)

+	if err != nil {

+		return nil, err

+	}

+	if _, err := verifier.Write(configJSON); err != nil {

+		return nil, err

+	}

+	if !verifier.Verified() {

+		err := fmt.Errorf("image config verification failed for digest %s", dgst)

+		logrus.Error(err)

+		return nil, err

+	}

+

+	return configJSON, nil

+}

+

+// schema2ManifestDigest computes the manifest digest, and, if pulling by

+// digest, ensures that it matches the requested digest.

+func schema2ManifestDigest(ref reference.Named, mfst distribution.Manifest) (digest.Digest, error) {

+	_, canonical, err := mfst.Payload()

+	if err != nil {

+		return "", err

+	}

+

+	// If pull by digest, then verify the manifest digest.

+	if digested, isDigested := ref.(reference.Canonical); isDigested {

+		verifier, err := digest.NewDigestVerifier(digested.Digest())

+		if err != nil {

+			return "", err

+		}

+		if _, err := verifier.Write(canonical); err != nil {

+			return "", err

+		}

+		if !verifier.Verified() {

+			err := fmt.Errorf("manifest verification failed for digest %s", digested.Digest())

+			logrus.Error(err)

+			return "", err

+		}

+		return digested.Digest(), nil

+	}

+

+	return digest.FromBytes(canonical), nil

 }

 // allowV1Fallback checks if the error is a possible reason to fallback to v1

@@ -353,7 +617,7 @@ func allowV1Fallback(err error) error {

 	return err

 }

-func verifyManifest(signedManifest *schema1.SignedManifest, ref reference.Named) (m *schema1.Manifest, err error) {

+func verifySchema1Manifest(signedManifest *schema1.SignedManifest, ref reference.Named) (m *schema1.Manifest, err error) {

 	// If pull by digest, then verify the manifest digest. NOTE: It is

 	// important to do this first, before any other content validation. If the

 	// digest cannot be verified, don't even bother with those other things.

@@ -362,13 +626,7 @@ func verifyManifest(signedManifest *schema1.SignedManifest, ref reference.Named)

 		if err != nil {

 			return nil, err

 		}

-		payload, err := signedManifest.Payload()

-		if err != nil {

-			// If this failed, the signatures section was corrupted

-			// or missing. Treat the entire manifest as the payload.

-			payload = signedManifest.Raw

-		}

-		if _, err := verifier.Write(payload); err != nil {

+		if _, err := verifier.Write(signedManifest.Canonical); err != nil {

 			return nil, err

 		}

 		if !verifier.Verified() {

@@ -376,15 +634,8 @@ func verifyManifest(signedManifest *schema1.SignedManifest, ref reference.Named)

 			logrus.Error(err)

 			return nil, err

 		}

-

-		var verifiedManifest schema1.Manifest

-		if err = json.Unmarshal(payload, &verifiedManifest); err != nil {

-			return nil, err

-		}

-		m = &verifiedManifest

-	} else {

-		m = &signedManifest.Manifest

 	}

+	m = &signedManifest.Manifest

 	if m.SchemaVersion != 1 {

 		return nil, fmt.Errorf("unsupported schema version %d for %q", m.SchemaVersion, ref.String())

@@ -123,7 +123,7 @@ func TestValidateManifest(t *testing.T) {

 		t.Fatal("error unmarshaling manifest:", err)

 	}

-	verifiedManifest, err := verifyManifest(&goodSignedManifest, expectedDigest)

+	verifiedManifest, err := verifySchema1Manifest(&goodSignedManifest, expectedDigest)

 	if err != nil {

 		t.Fatal("validateManifest failed:", err)

 	}

@@ -145,7 +145,7 @@ func TestValidateManifest(t *testing.T) {

 		t.Fatal("error unmarshaling manifest:", err)

 	}

-	verifiedManifest, err = verifyManifest(&extraDataSignedManifest, expectedDigest)

+	verifiedManifest, err = verifySchema1Manifest(&extraDataSignedManifest, expectedDigest)

 	if err != nil {

 		t.Fatal("validateManifest failed:", err)

 	}

@@ -167,7 +167,7 @@ func TestValidateManifest(t *testing.T) {

 		t.Fatal("error unmarshaling manifest:", err)

 	}

-	verifiedManifest, err = verifyManifest(&badSignedManifest, expectedDigest)

+	verifiedManifest, err = verifySchema1Manifest(&badSignedManifest, expectedDigest)

 	if err == nil || !strings.HasPrefix(err.Error(), "image verification failed for digest") {

 		t.Fatal("expected validateManifest to fail with digest error")

 	}

@@ -7,7 +7,6 @@ import (

 	"io"

 	"github.com/Sirupsen/logrus"

-	"github.com/docker/distribution/digest"

 	"github.com/docker/docker/distribution/metadata"

 	"github.com/docker/docker/distribution/xfer"

 	"github.com/docker/docker/image"

@@ -77,7 +76,6 @@ func NewPusher(ref reference.Named, endpoint registry.APIEndpoint, repoInfo *reg

 			endpoint:       endpoint,

 			repoInfo:       repoInfo,

 			config:         imagePushConfig,

-			layersPushed:   pushMap{layersPushed: make(map[digest.Digest]bool)},

 		}, nil

 	case registry.APIVersion1:

 		return &v1Pusher{

@@ -1,22 +1,20 @@

 package distribution

 import (

-	"encoding/json"

 	"errors"

 	"fmt"

 	"io"

 	"sync"

-	"time"

 	"github.com/Sirupsen/logrus"

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/digest"

-	"github.com/docker/distribution/manifest"

 	"github.com/docker/distribution/manifest/schema1"

+	"github.com/docker/distribution/manifest/schema2"

+	"github.com/docker/distribution/registry/client"

 	"github.com/docker/docker/distribution/metadata"

 	"github.com/docker/docker/distribution/xfer"

 	"github.com/docker/docker/image"

-	"github.com/docker/docker/image/v1"

 	"github.com/docker/docker/layer"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/progress"

@@ -43,75 +41,75 @@ type v2Pusher struct {

 	config         *ImagePushConfig

 	repo           distribution.Repository

-	// confirmedV2 is set to true if we confirm we're talking to a v2

-	// registry. This is used to limit fallbacks to the v1 protocol.

-	confirmedV2 bool

-

-	// layersPushed is the set of layers known to exist on the remote side.

-	// This avoids redundant queries when pushing multiple tags that

-	// involve the same layers.

-	layersPushed pushMap

+	// pushState is state built by the Download functions.

+	pushState pushState

 }

-type pushMap struct {

+type pushState struct {

 	sync.Mutex

-	layersPushed map[digest.Digest]bool

+	// remoteLayers is the set of layers known to exist on the remote side.

+	// This avoids redundant queries when pushing multiple tags that

+	// involve the same layers. It is also used to fill in digest and size

+	// information when building the manifest.

+	remoteLayers map[layer.DiffID]distribution.Descriptor

+	// confirmedV2 is set to true if we confirm we're talking to a v2

+	// registry. This is used to limit fallbacks to the v1 protocol.

+	confirmedV2 bool

 }

 func (p *v2Pusher) Push(ctx context.Context) (err error) {

-	p.repo, p.confirmedV2, err = NewV2Repository(ctx, p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "push", "pull")

+	p.pushState.remoteLayers = make(map[layer.DiffID]distribution.Descriptor)

+

+	p.repo, p.pushState.confirmedV2, err = NewV2Repository(ctx, p.repoInfo, p.endpoint, p.config.MetaHeaders, p.config.AuthConfig, "push", "pull")

 	if err != nil {

 		logrus.Debugf("Error getting v2 registry: %v", err)

-		return fallbackError{err: err, confirmedV2: p.confirmedV2}

+		return fallbackError{err: err, confirmedV2: p.pushState.confirmedV2}

 	}

 	if err = p.pushV2Repository(ctx); err != nil {

 		if registry.ContinueOnError(err) {

-			return fallbackError{err: err, confirmedV2: p.confirmedV2}

+			return fallbackError{err: err, confirmedV2: p.pushState.confirmedV2}

 		}

 	}

 	return err

 }

 func (p *v2Pusher) pushV2Repository(ctx context.Context) (err error) {

-	var associations []reference.Association

-	if _, isTagged := p.ref.(reference.NamedTagged); isTagged {

+	if namedTagged, isNamedTagged := p.ref.(reference.NamedTagged); isNamedTagged {

 		imageID, err := p.config.ReferenceStore.Get(p.ref)

 		if err != nil {

 			return fmt.Errorf("tag does not exist: %s", p.ref.String())

 		}

-		associations = []reference.Association{

-			{

-				Ref:     p.ref,

-				ImageID: imageID,

-			},

-		}

-	} else {

-		// Pull all tags

-		associations = p.config.ReferenceStore.ReferencesByName(p.ref)

-	}

-	if err != nil {

-		return fmt.Errorf("error getting tags for %s: %s", p.repoInfo.Name(), err)

+		return p.pushV2Tag(ctx, namedTagged, imageID)

 	}

-	if len(associations) == 0 {

-		return fmt.Errorf("no tags to push for %s", p.repoInfo.Name())

+

+	if !reference.IsNameOnly(p.ref) {

+		return errors.New("cannot push a digest reference")

 	}

-	for _, association := range associations {

-		if err := p.pushV2Tag(ctx, association); err != nil {

-			return err

+	// Pull all tags

+	pushed := 0

+	for _, association := range p.config.ReferenceStore.ReferencesByName(p.ref) {

+		if namedTagged, isNamedTagged := association.Ref.(reference.NamedTagged); isNamedTagged {

+			pushed++

+			if err := p.pushV2Tag(ctx, namedTagged, association.ImageID); err != nil {

+				return err

+			}

 		}

 	}

+	if pushed == 0 {

+		return fmt.Errorf("no tags to push for %s", p.repoInfo.Name())

+	}

+

 	return nil

 }

-func (p *v2Pusher) pushV2Tag(ctx context.Context, association reference.Association) error {

-	ref := association.Ref

+func (p *v2Pusher) pushV2Tag(ctx context.Context, ref reference.NamedTagged, imageID image.ID) error {

 	logrus.Debugf("Pushing repository: %s", ref.String())

-	img, err := p.config.ImageStore.Get(association.ImageID)

+	img, err := p.config.ImageStore.Get(imageID)

 	if err != nil {

 		return fmt.Errorf("could not find image from tag %s: %v", ref.String(), err)

 	}

@@ -134,18 +132,7 @@ func (p *v2Pusher) pushV2Tag(ctx context.Context, association reference.Associat

 	descriptorTemplate := v2PushDescriptor{

 		blobSumService: p.blobSumService,

 		repo:           p.repo,

-		layersPushed:   &p.layersPushed,

-		confirmedV2:    &p.confirmedV2,

-	}

-

-	// Push empty layer if necessary

-	for _, h := range img.History {

-		if h.EmptyLayer {

-			descriptor := descriptorTemplate

-			descriptor.layer = layer.EmptyLayer

-			descriptors = []xfer.UploadDescriptor{&descriptor}

-			break

-		}

+		pushState:      &p.pushState,

 	}

 	// Loop bounds condition is to avoid pushing the base layer on Windows.

@@ -157,52 +144,75 @@ func (p *v2Pusher) pushV2Tag(ctx context.Context, association reference.Associat

 		l = l.Parent()

 	}

-	fsLayers, err := p.config.UploadManager.Upload(ctx, descriptors, p.config.ProgressOutput)

-	if err != nil {

+	if err := p.config.UploadManager.Upload(ctx, descriptors, p.config.ProgressOutput); err != nil {

 		return err

 	}

-	var tag string

-	if tagged, isTagged := ref.(reference.NamedTagged); isTagged {

-		tag = tagged.Tag()

-	}

-	m, err := CreateV2Manifest(p.repo.Name(), tag, img, fsLayers)

+	// Try schema2 first

+	builder := schema2.NewManifestBuilder(p.repo.Blobs(ctx), img.RawJSON())

+	manifest, err := manifestFromBuilder(ctx, builder, descriptors)

 	if err != nil {

 		return err

 	}

-	logrus.Infof("Signed manifest for %s using daemon's key: %s", ref.String(), p.config.TrustKey.KeyID())

-	signed, err := schema1.Sign(m, p.config.TrustKey)

+	manSvc, err := p.repo.Manifests(ctx)

 	if err != nil {

 		return err

 	}

-	manifestDigest, manifestSize, err := digestFromManifest(signed, ref)

-	if err != nil {

-		return err

+	putOptions := []distribution.ManifestServiceOption{client.WithTag(ref.Tag())}

+	if _, err = manSvc.Put(ctx, manifest, putOptions...); err != nil {

+		logrus.Warnf("failed to upload schema2 manifest: %v - falling back to schema1", err)

+

+		builder = schema1.NewConfigManifestBuilder(p.repo.Blobs(ctx), p.config.TrustKey, p.repo.Name(), ref.Tag(), img.RawJSON())

+		manifest, err = manifestFromBuilder(ctx, builder, descriptors)

+		if err != nil {

+			return err

+		}

+

+		if _, err = manSvc.Put(ctx, manifest, putOptions...); err != nil {

+			return err

+		}

 	}

-	if manifestDigest != "" {

-		if tagged, isTagged := ref.(reference.NamedTagged); isTagged {

-			progress.Messagef(p.config.ProgressOutput, "", "%s: digest: %s size: %d", tagged.Tag(), manifestDigest, manifestSize)

-			// Signal digest to the trust client so it can sign the

-			// push, if appropriate.

-			progress.Aux(p.config.ProgressOutput, PushResult{Tag: tagged.Tag(), Digest: manifestDigest, Size: manifestSize})

+

+	var canonicalManifest []byte

+

+	switch v := manifest.(type) {

+	case *schema1.SignedManifest:

+		canonicalManifest = v.Canonical

+	case *schema2.DeserializedManifest:

+		_, canonicalManifest, err = v.Payload()

+		if err != nil {

+			return err

 		}

 	}

-	manSvc, err := p.repo.Manifests(ctx)

-	if err != nil {

-		return err

+	manifestDigest := digest.FromBytes(canonicalManifest)

+	progress.Messagef(p.config.ProgressOutput, "", "%s: digest: %s size: %d", ref.Tag(), manifestDigest, len(canonicalManifest))

+	// Signal digest to the trust client so it can sign the

+	// push, if appropriate.

+	progress.Aux(p.config.ProgressOutput, PushResult{Tag: ref.Tag(), Digest: manifestDigest, Size: len(canonicalManifest)})

+

+	return nil

+}

+

+func manifestFromBuilder(ctx context.Context, builder distribution.ManifestBuilder, descriptors []xfer.UploadDescriptor) (distribution.Manifest, error) {

+	// descriptors is in reverse order; iterate backwards to get references

+	// appended in the right order.

+	for i := len(descriptors) - 1; i >= 0; i-- {

+		if err := builder.AppendReference(descriptors[i].(*v2PushDescriptor)); err != nil {

+			return nil, err

+		}

 	}

-	return manSvc.Put(signed)

+

+	return builder.Build(ctx)

 }

 type v2PushDescriptor struct {

 	layer          layer.Layer

 	blobSumService *metadata.BlobSumService

 	repo           distribution.Repository

-	layersPushed   *pushMap

-	confirmedV2    *bool

+	pushState      *pushState

 }

 func (pd *v2PushDescriptor) Key() string {

@@ -217,25 +227,38 @@ func (pd *v2PushDescriptor) DiffID() layer.DiffID {

 	return pd.layer.DiffID()

 }

-func (pd *v2PushDescriptor) Upload(ctx context.Context, progressOutput progress.Output) (digest.Digest, error) {

+func (pd *v2PushDescriptor) Upload(ctx context.Context, progressOutput progress.Output) error {

 	diffID := pd.DiffID()

-	logrus.Debugf("Pushing layer: %s", diffID)

+	pd.pushState.Lock()

+	if _, ok := pd.pushState.remoteLayers[diffID]; ok {

+		// it is already known that the push is not needed and

+		// therefore doing a stat is unnecessary

+		pd.pushState.Unlock()

+		progress.Update(progressOutput, pd.ID(), "Layer already exists")

+		return nil

+	}

+	pd.pushState.Unlock()