3c72ef762b
Merge pull request #482 from docker/random-lint-fix
...
Add some comments about the notary constants, and other lint fixes.
2016-01-19 23:39:11 -08:00
6f2e851b29
Merge pull request #479 from docker/remove_to_lower
...
Do not lowercase role names when adding a change
2016-01-19 16:22:41 -08:00
2ff7bf6375
Add some comments about the notary constants, and other lint fixes.
...
It seems that `make vet` sometimes disagrees locally vs on CircleCI. This
just fixes my local `make vet` complaints.
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-19 15:55:47 -08:00
a3b9a5543f
Do not lowercase role names when adding a change
...
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-19 14:32:00 -08:00
cf0bb5a9be
Merge pull request #440 from docker/diogo-cli-adding-delegations
...
delegation command for notary-cli
2016-01-19 13:54:56 -08:00
ca67f1e71a
client library deletion functionality, and integration into remove cert
...
CLI
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-01-19 11:18:33 -08:00
138d6cea09
Add, remove, and list delegation command. TUF changelist action change
...
for deletions (force vs. individual items)
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2016-01-18 16:24:45 -08:00
c0fb05584e
fixing incorrect comments
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-15 11:30:32 -08:00
9e80ad8158
remove certs.NewManager function
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-15 11:30:32 -08:00
a8b21cafe0
CertManager is completely removed
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-15 11:30:32 -08:00
d4820c5756
Translate ErrMetaNotFound when updating, so long as it's on root, to ErrRepositoryNotExist.
...
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-14 15:27:11 -08:00
f57f2beb08
Factor marshalling a SignedRoot into JSON into TUF/data/root.go, and
...
add an injectable serializer (so we can test JSON marshalling/unmarshalling
error propagation).
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-14 10:51:24 -08:00
b74f1835b7
Ensure that we do not unnecessarily re-sign/serialize a root.json file on publish
...
Adds additional tests to ensure that keys aren't unnecessarily created on error,
and that only the required keys to sign are used.
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-14 10:51:24 -08:00
26d3f3f92b
Merge pull request #413 from endophage/fix_root_download
...
fixing bootstrapClient to prefer cached root
2016-01-13 15:48:39 -08:00
06d23e14c9
add test for invalid remote URL
...
add offline store for use when we can't initialize a remote store
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-13 15:26:57 -08:00
cf4b77b760
Revert "switching out to consistently use canonical json for all marshalling of TUF data"
...
This reverts commit f417c834c4
2016-01-08 14:53:09 -08:00
6d72fe7fd1
adding comment to bootstrapClient
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-08 09:03:27 -08:00
d11f11748c
when we download during bootstrapClient we should save the root to cache
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-08 09:03:03 -08:00
762c997104
fixing bootstrapClient to prefer cached root
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-08 09:03:03 -08:00
c1c0ccf4be
Combine bootstrapClient and tuf/client's Client.Update into NotaryRepository.Update.
...
- it is easier to understand what's going on in the online functions of NotaryRepository
- we can test NotaryRepository.Update independently (although it'd be nice to have some way
of ensuring that the actual public functions of NotaryRepository like ListTargets,
GetTargetByName, and Publish actually calls Update.
- distinct error if the remote repo doesn't exist.
This also stops wrapping signed.ErrExpired in client.ErrExpired, and just passes
signed.ErrExpired on directly.
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-07 16:58:46 -08:00
f417c834c4
switching out to consistently use canonical json for all marshalling of TUF data
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2016-01-06 11:15:27 -08:00
61bbf7be49
Change ListTargetes and GetTargetsByName to return TargetWithRole.
...
This object has both the target and the role in which the target was found.
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-04 17:15:44 -08:00
9252d9d892
Update client.Target to include a RoleName, so we know where the target is when listed.
...
Signed-off-by: Ying Li <ying.li@docker.com>
2016-01-04 10:49:54 -08:00
ffca6fb522
Merge pull request #388 from docker/cleanup
...
Rebased cleanup/remove PEM headers
2015-12-23 11:36:25 -08:00
fa788cb2a9
make x509 certs viable as delegated public key object
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-23 09:41:03 -08:00
98b7dd7daf
fixes to notary for docker integration
...
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
2015-12-22 16:53:31 -08:00
0892ebb13f
Add checks to TUFRepo to fail on updating a target if there are no signing keys.
...
So UpdateDelegation, DeleteDelegation, AddTargets, RemoveTargets now
all check for the role existence, not metadata existence. And they
also check the role's signing keys - there's no point in adding if
we can't sign.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-18 16:37:24 -08:00
a1cbe5d43c
Add test for, and fix bug with, publishing a bare repo not sending the targets file.
...
It should always be published the first time, like the root.json.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-18 16:37:24 -08:00
c12958af36
Do not sign the actual targets metadata unless it's dirty.
...
Previously we were always signing it, but we can't do that anymore
because then delegated users won't be able to publish ever (they
probably don't have the target key).
Some other related changes: when role keys are rotated, that role
needs to be marked as dirty now in order to be re-signed and
published.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-18 16:37:24 -08:00
3ecba24410
When publishing, also publish all the dirty targets roles.
...
This is in addition to the canonical targets role, which always gets
re-signed and publish (we may want to revisit this later).
This makes some tests pass - still need to do fallback of roles
and publishing a created delegation role without necessarily
having the signing key for that role.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-18 16:37:24 -08:00
d3a54cab25
the empty string should be used in delegation Paths to indicate a role can sign anything
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-18 16:10:43 -08:00
a2a4870512
adding comment about priority ordering and updating test for ListTargets with delegates to hit default no roles passed case
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-18 11:21:12 -08:00
574b4d543d
updating ListTargets delegate test to check iteration of children and correct (lack of) overwriting.
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 21:28:52 -08:00
9307692b52
reverse priority order or roles for ListTargets and GetTargetsByName
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 16:33:52 -08:00
594049b24f
fixing download to continue if we get ErrMetaNotFound
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 15:53:57 -08:00
f72f799806
fixing up ListTargets and GetTargetByName to process prioritized roles more efficiently
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 14:56:05 -08:00
4243b258b3
making GetTargetsByName work with delegations
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 10:46:41 -08:00
4694178bbe
download delegation test
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 10:09:34 -08:00
377b72a54f
updating list targets to list across multiple roles
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 10:09:34 -08:00
8f7e7adcef
making stack thread safe
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-17 10:09:34 -08:00
351d5483b7
Implement RemoveDelegation for NotaryRepository.
...
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-16 16:01:17 -08:00
c72934794a
Implement AddDelegation for NotaryRepository.
...
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-16 16:00:45 -08:00
22aefc9317
Make the addChange code easier to read using the IsDelegation function
...
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-16 14:31:45 -08:00
0bec06eb9b
RemoveTarget now takes an optional variadic list of roles to remove from.
...
If none are provided, it defaults to the targets role, as before.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-16 13:18:40 -08:00
19c49cf7ce
AddTarget now takes an optional variadic list of roles to add target to.
...
If none are provided, it defaults to the targets role, as before.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-16 13:18:40 -08:00
01f42b7313
Merge pull request #354 from endophage/delegations
...
Delegation primitives up to changelist level
2015-12-15 16:34:46 -08:00
5891805b29
addressing review
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-15 16:21:30 -08:00
2c7e632925
Amend rotation tests to assert old keys are removed after rotation.
...
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-14 17:44:28 -08:00
79b05d4c0a
changelists for delegations
...
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)
2015-12-14 17:23:47 -08:00
8521ea5b6d
Convert NotaryRepository.RotateKeys to RotateKey(role, serverManages bool)
...
This should make it possible to delegate snapshot key management
to the server for existing repos, or switching back to user managing
snapshot keys.
Signed-off-by: Ying Li <ying.li@docker.com>
2015-12-14 17:17:23 -08:00
Ying Li
Ying Li
Riyaz Faizullabhoy
David Lawrence
Diogo Mónica
David Lawrence