diff --git a/Makefile b/Makefile
index e09918c1a7..d6b7dc4c10 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"
 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"
 GOOSES = darwin freebsd linux
 GOARCHS = amd64
-NOTARY_BUILDTAGS="pkcs11"
+NOTARY_BUILDTAGS ?= "pkcs11"
 GO_EXC = go
 NOTARYDIR := /go/src/github.com/docker/notary
 
@@ -27,6 +27,9 @@ else
 $(error You are importing pkcs11 somewhere and not using a build tag)
 endif
 
+_empty :=
+_space := $(empty) $(empty)
+
 # go cover test variables
 COVERDIR=.cover
 COVERPROFILE=$(COVERDIR)/cover.out
@@ -82,16 +85,16 @@ lint:
 
 build: go_version
 	@echo "+ $@"
-	@go build -tags ${NOTARY_BUILDTAGS} -v ${GO_LDFLAGS} ./...
+	@go build -tags "${NOTARY_BUILDTAGS}" -v ${GO_LDFLAGS} ./...
 
-test: OPTS =
+test: TESTOPTS =
 test: go_version
-	@echo "+ $@ $(OPTS)"
-	go test -tags ${NOTARY_BUILDTAGS} $(OPTS) ./...
+	@echo "+ $@ $(TESTOPTS)"
+	go test -tags "${NOTARY_BUILDTAGS}" $(TESTOPTS) ./...
 
 test-full: vet lint
 	@echo "+ $@"
-	go test -tags ${NOTARY_BUILDTAGS} -v ./...
+	go test -tags "${NOTARY_BUILDTAGS}" -v ./...
 
 protos:
 	@protoc --go_out=plugins=grpc:. proto/*.proto
@@ -103,25 +106,24 @@ protos:
 # be run first
 
 define gocover
-$(GO_EXC) test $(OPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).cover" "$(1)" || exit 1;
+$(GO_EXC) test $(OPTS) $(TESTOPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).$(subst $(_space),.,$(NOTARY_BUILDTAGS)).cover" "$(1)" || exit 1;
 endef
 
 gen-cover: go_version
-	@rm -rf "$(COVERDIR)"
 	@mkdir -p "$(COVERDIR)"
 	$(foreach PKG,$(PKGS),$(call gocover,$(PKG)))
 
 cover: GO_EXC := go
-       OPTS = -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
-cover: gen-cover
-	@gocovmerge $(shell ls -1 $(COVERDIR)/* | tr "\n" " ") > $(COVERPROFILE)
-	@go tool cover -func="$(COVERPROFILE)"
+       OPTS = -tags "${NOTARY_BUILDTAGS}" -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
+cover: gen-cover covmerge
 	@go tool cover -html="$(COVERPROFILE)"
 
 # Codecov knows how to merge multiple coverage files
-ci: OPTS = -tags ${NOTARY_BUILDTAGS} -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
+ci: OPTS = -tags "${NOTARY_BUILDTAGS}" -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
     GO_EXC := godep go
 ci: gen-cover
+
+covmerge:
 	@gocovmerge $(shell ls -1 $(COVERDIR)/* | tr "\n" " ") > $(COVERPROFILE)
 	@go tool cover -func="$(COVERPROFILE)"
 
@@ -157,4 +159,5 @@ shell: notary-dockerfile
 
 clean:
 	@echo "+ $@"
+	@rm -rf "$(COVERDIR)"
 	@rm -rf "${PREFIX}/bin/notary-server" "${PREFIX}/bin/notary" "${PREFIX}/bin/notary-signer"
diff --git a/circle.yml b/circle.yml
index fb89862fed..a40e94b5c5 100644
--- a/circle.yml
+++ b/circle.yml
@@ -45,6 +45,10 @@ test:
   # Output the go versions we are going to test
     - gvm use stable && go version
 
+  # CLEAN
+    - gvm use stable && make clean:
+        pwd: $BASE_STABLE
+
   # FMT
     - gvm use stable && make fmt:
         pwd: $BASE_STABLE
@@ -59,11 +63,17 @@ test:
 
   override:
   # Test stable, and report
-    - gvm use stable && make ci:
+  # hacking this to be parallel
+    - case $CIRCLE_NODE_INDEX in 0) gvm use stable && NOTARY_BUILDTAGS=pkcs11 make ci ;; 1) gvm use stable && NOTARY_BUILDTAGS=none make ci ;; esac:
+        parallel: true
         timeout: 600
         pwd: $BASE_STABLE
 
   post:
+    - gvm use stable && make covmerge:
+        timeout: 600
+        pwd: $BASE_STABLE
+
   # Report to codecov.io
     # - bash <(curl -s https://codecov.io/bash):
     #     pwd: $BASE_STABLE
diff --git a/client/repo.go b/client/repo.go
index 43f4ed78ce..d289d7ab68 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"path/filepath"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
@@ -22,7 +21,7 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
+		return nil, fmt.Errorf("failed to create private key store in directory: %s", baseDir)
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)