@@ -64,7 +64,7 @@ clone git github.com/vdemeester/shakers 24d7f1d6a71aa5d9cbe7390e4afb66b7eef9e1b3

 clone git golang.org/x/net 2beffdc2e92c8a3027590f898fe88f69af48a3f8 https://github.com/tonistiigi/net.git

 clone git golang.org/x/sys eb2c74142fd19a79b3f237334c7384d5167b1b46 https://github.com/golang/sys.git

 clone git github.com/docker/go-units 8a7beacffa3009a9ac66bad506b18ffdd110cf97

-clone git github.com/docker/go-connections 1494b6df4050e60923d68cd8cc6a19e7af9f1c01

+clone git github.com/docker/go-connections f512407a188ecb16f31a33dbc9c4e4814afc1b03

 clone git github.com/RackSec/srslog 365bf33cd9acc21ae1c355209865f17228ca534e

 clone git github.com/imdario/mergo 0.2.1

new file mode 100644

@@ -0,0 +1,21 @@

+// +build go1.7

+

+package tlsconfig

+

+import (

+	"crypto/x509"

+	"runtime"

+

+	"github.com/Sirupsen/logrus"

+)

+

+// SystemCertPool returns a copy of the system cert pool,

+// returns an error if failed to load or empty pool on windows.

+func SystemCertPool() (*x509.CertPool, error) {

+	certpool, err := x509.SystemCertPool()

+	if err != nil && runtime.GOOS == "windows" {

+		logrus.Warnf("Unable to use system certificate pool: %v", err)

+		return x509.NewCertPool(), nil

+	}

+	return certpool, err

+}

new file mode 100644

@@ -0,0 +1,16 @@

+// +build !go1.7

+

+package tlsconfig

+

+import (

+	"crypto/x509"

+

+	"github.com/Sirupsen/logrus"

+)

+

+// SystemCertPool returns an new empty cert pool,

+// accessing system cert pool is supported in go 1.7

+func SystemCertPool() (*x509.CertPool, error) {

+	logrus.Warn("Unable to use system certificate pool: requires building with go 1.7 or later")

+	return x509.NewCertPool(), nil

+}

@@ -68,10 +68,13 @@ func ClientDefault() *tls.Config {

 // certPool returns an X.509 certificate pool from `caFile`, the certificate file.

 func certPool(caFile string) (*x509.CertPool, error) {

 	// If we should verify the server, we need to load a trusted ca

-	certPool := x509.NewCertPool()

+	certPool, err := SystemCertPool()

+	if err != nil {

+		return nil, fmt.Errorf("failed to read system certificates: %v", err)

+	}

 	pem, err := ioutil.ReadFile(caFile)

 	if err != nil {

-		return nil, fmt.Errorf("Could not read CA certificate %q: %v", caFile, err)

+		return nil, fmt.Errorf("could not read CA certificate %q: %v", caFile, err)

 	}

 	if !certPool.AppendCertsFromPEM(pem) {

 		return nil, fmt.Errorf("failed to append certificates from PEM file: %q", caFile)