{"push_id":887575837,"size":32,"distinct_size":10,"ref":"refs/heads/cert-rotation","head":"22c7fde95d347cd5c3ea8352fac581d1d260c8f7","before":"9c44d97928d810c0c5ec88942395555673580186","commits":[{"sha":"b1fdea5b56e869bc5c0d2ee91913543eee933a40","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Add shared config file parsing to the utils package.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/b1fdea5b56e869bc5c0d2ee91913543eee933a40"},{"sha":"b25f8546f83b503cb21f350f7e1263d66e5d6df8","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Ensure that environment variables can override config file entries.\n\nAlso support parameterized allowed backends when parsing for\nstorage backends, so that a DB backend can be tested.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/b25f8546f83b503cb21f350f7e1263d66e5d6df8"},{"sha":"9e5ac006ecb61675f42d65c6a6ce7cff472d7e8e","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Use the shared configuration parsing code in notary-signer's parsing.\n\nAlso add bugsnag support to notary-signer.\n\nThis also changes the 'server.cert_file' and 'server.key_file'\nparameters to 'server.tls_cert_file' and 'server.tls_key_file',\nrespectively, to match notary-server.\n\nPreviously, the default alias, which was under the environment\nvariable NOTARY_SERVER_DEFAULT_ALIAS is now also available in\nthe config file in storage.default_alias.  The password has\nnot changed.\n\nFinally, this removes some of the HSM references in notary-signer.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/9e5ac006ecb61675f42d65c6a6ce7cff472d7e8e"},{"sha":"c43776d36f8173c6d430724e6167f21c1eafc307","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Use shared configuration parsing tools in notary-server.\n\nThis changes the 'addr' parameter of notary-server's config to\n'http_addr', so we can add a GRPC server to notary-server if\nnecessary.  This also allows environment variables to override\nthe notary-server config file entries, as notary-signer already\ndoes.\n\nThe bugsnag configuration has also been changed so that the\nbugsnag parameters are under the \"bugsnag\" key.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/c43776d36f8173c6d430724e6167f21c1eafc307"},{"sha":"f1bd28caf4efcd475fb57d4e638b1ac9458a835e","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"The TLS certificates are now relative to the config file used.\n\nPreviously, if a relative path was provided, it was relative to the\ncurrent working directory to wherever the binaries were run.  Now\nit is relative to whatever config file was used.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/f1bd28caf4efcd475fb57d4e638b1ac9458a835e"},{"sha":"a94a47651f7d679cbde50cb33638b72396fdc7ea","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Adds specific memory backend support to server and signer.\n\nThe server already supported a memory backend, but now it must be\nspecified, rather than just being a fallback if no storage is\nspecified.  This also adds a signer backend to signer, which\npreviously required a MySQL backend.\n\nThanks @endophage for the excellent suggestion!\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/a94a47651f7d679cbde50cb33638b72396fdc7ea"},{"sha":"56e8d864ce3ca94cd8fe80484835cf7bd9dda0a6","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Add some standalone (does not require MySQL) configuration files for\nserver and signer, and set these to be the default configuration\nfiles when running the images.\n\nCompose specifies the configuration with MySQL.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/56e8d864ce3ca94cd8fe80484835cf7bd9dda0a6"},{"sha":"7153dc74633472e9741b7d87930e2bf59debcd62","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Fix bug with keystore not getting assigned in the signer in the DB case.\n\nThanks @endophage!\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/7153dc74633472e9741b7d87930e2bf59debcd62"},{"sha":"5500c81cd91f4b2355ab50ac9e7929a292ae1a03","author":{"email":"5144c042720ac4240240f0ad1d5bf334d216b5f9@gmail.com","name":"David Lawrence"},"message":"Merge pull request #304 from docker/server-signer-config\n\nMake the server/signer configurations more similar","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/5500c81cd91f4b2355ab50ac9e7929a292ae1a03"},{"sha":"d62ac788a3863a874f04ea1dfd31014e6e486bfc","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Fixed bug parsing trust service info in notary server.\n\nPreviously, if it wasn't a remote service, the config parser was\nstill setting the key algorithm to be whatever was configured.\nNow, if we are using a local trust service, the algorithm is always\nED25519.\n\nAlso broke the trust parsing into its own function for testing.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/d62ac788a3863a874f04ea1dfd31014e6e486bfc"},{"sha":"1dd04d4e5d22aae5cab96c65a5c452f2529bac15","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"trust_service is now a required section of the notary-server config.\n\nThe type must either be \"local\" or \"remote\".  Previously, any invalid\nconfiguration would default to a local signing service, but since\na remote signing service is recommended, the user has to specifically\nconfigure a local signing service.  We don't want it to be the\nfallback.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/1dd04d4e5d22aae5cab96c65a5c452f2529bac15"},{"sha":"870fe0fd01b6e84af59b96a8ff968b5cbe617f57","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Define injected function types for notary-server/main.getTrustService\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/870fe0fd01b6e84af59b96a8ff968b5cbe617f57"},{"sha":"8292d1866d8b7c2825fac653769568aa6ce2ab36","author":{"email":"5144c042720ac4240240f0ad1d5bf334d216b5f9@gmail.com","name":"David Lawrence"},"message":"Merge pull request #299 from docker/server-parsing-trust\n\nFixed bug parsing trust service info in notary server.","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/8292d1866d8b7c2825fac653769568aa6ce2ab36"},{"sha":"be1c82b377c7a3bed1e9cfaac8aeae9ae9562770","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Add gun to CryptoServiceTester\n\nThe gun field is not necessary yet, but will be useful in a future\ncommit. But including it immediately allows us to simplify by using\nan ordinary method for cryptoServiceFactory instead of closures.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/be1c82b377c7a3bed1e9cfaac8aeae9ae9562770"},{"sha":"1ca09b157aac32b09a46b352acf810a25d22dfbb","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Fix error handling on invalid root passphrase\n\nWhen the user insists on an invalid passphrase (or aborts the\noperation), CryptoService.GetPrivateKey will try the correct root\nlocation first, correctly failing, and then try to look for the root key\nin the $gun subdirectory, and so will return the last error, a confusing\n”open $path: no such file or directory”.\n\nSo, recognize the passphrase-related errors and fail with them directly.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/1ca09b157aac32b09a46b352acf810a25d22dfbb"},{"sha":"e158d389300f535de28331bcbcdb8c3a6ac12c6c","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Remove misleading passphrase-related error handling in NotaryRepository.Initialize:\n\n1. It is on a path where those errors can never happen\n2. The specific error handling would silently ignore the error, which\n   can’t be right anyway.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/e158d389300f535de28331bcbcdb8c3a6ac12c6c"},{"sha":"c536010b964c19ad242931d36f94e8a378717410","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Remove an incorrect comment.\n\nThe commented code is not converting DER to PEM, it is parsing DER into\nan in-memory data structure, and is hopefully just as clear without a\ncomment.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/c536010b964c19ad242931d36f94e8a378717410"},{"sha":"02417c71d31d833200134699fb40f1a726610cfe","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Add cryptoservice.GenerateTestingCertificate\n\nVarious tests have been calling trustmanager.NewCertificate and\nopen-coding most of cryptoservice.GenerateCertificate.  So, add\ncryptoservice.GenerateTestingCertificate.  It differs only by using\ncrypto.Signer instead of data.PrivateKey because the tests\nhave a crypto.Signer more frequently available, and converting\nfrom data.PrivateKey to crypto.Signer is easier than the other way.\n\nThis will make it easier to add policy parameters which the tests don't\ncare about to trustmanager.NewCertificate and\ncryptoservice.GenerateCertificate in the future.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/02417c71d31d833200134699fb40f1a726610cfe"},{"sha":"8e8af9cc24cb79a0ed1ca18346ba6a02becd45ca","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Explicitly supply validity times to certificate generation\n\nAdd explicit startTime and endTime parameters to\ncryptoservice.GenerateCertificate and trustmanager.NewCertificate.\n\ntrustmanager.NewCertificate as a low-level data manipulation function\nshould not be hard-coding policy (10-year expiration); that policy\nbelongs to its callers, or one more level higher to callers of\ncryptoservice.GenerateCertificate.\n\nThese places hard-coding policy now also have an explict comment to\nthat effect.\n\nIn addition to conceptual cleanliness, this will allow writing tests\nof certificate expiry by generating appropriate expired or nearly-expired\ncertificates.\n\nTests which don't care about the policy much will continue to use the\njust added cryptoservice.GenerateTestingCertificate.\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/8e8af9cc24cb79a0ed1ca18346ba6a02becd45ca"},{"sha":"856f9021c8f08e9e6c7c7d43b9cec64d531a3605","author":{"email":"9c008e38982a5397deb855345fb164f0558459ae@redhat.com","name":"Miloslav Trmač"},"message":"Fix computation of certificate expiration\n\nInstead of 3650 days, actually use 10 years (i.e. take into account leap\ndays).\n\nSigned-off-by: Miloslav Trmač <mitr@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mtrmac/notary/commits/856f9021c8f08e9e6c7c7d43b9cec64d531a3605"}]}