{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/31476202","id":31476202,"diff_hunk":"@@ -0,0 +1,97 @@\n+// Package tlsconfig provides primitives to retrieve secure-enough TLS configurations for both clients and servers.\n+//\n+// As a reminder from https://golang.org/pkg/crypto/tls/#Config:\n+//\tA Config structure is used to configure a TLS client or server. After one has been passed to a TLS function it must not be modified.\n+//\tA Config may be reused; the tls package will also not modify it.\n+package tlsconfig\n+\n+import (\n+\t\"crypto/tls\"\n+\t\"crypto/x509\"\n+\t\"fmt\"\n+\t\"io/ioutil\"\n+\t\"os\"\n+)\n+\n+// NewConfig returns a secure-enough-by-default TLS configuration object.\n+func New() *tls.Config {\n+\treturn &tls.Config{\n+\t\t// Avoid fallback to SSL protocols < TLS1.0\n+\t\tMinVersion:               tls.VersionTLS10,\n+\t\tPreferServerCipherSuites: true,\n+\t\tCipherSuites: []uint16{\n+\t\t\ttls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,\n+\t\t\ttls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\n+\t\t\ttls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,\n+\t\t\ttls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,\n+\t\t\ttls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,\n+\t\t\ttls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,\n+\t\t\ttls.TLS_RSA_WITH_AES_128_CBC_SHA,\n+\t\t\ttls.TLS_RSA_WITH_AES_256_CBC_SHA,\n+\t\t},\n+\t}\n+}\n+\n+// certPool returns an X.509 certificate pool from `ca`, the certificate file.\n+func certPool(ca string) (*x509.CertPool, error) {\n+\t// If we should verify the server, we need to load a trusted ca\n+\tcertPool := x509.NewCertPool()\n+\tfile, err := ioutil.ReadFile(ca)\n+\tif err != nil {\n+\t\treturn nil, fmt.Errorf(\"Could not read CA certificate %s: %v\", ca, err)\n+\t}\n+\tcertPool.AppendCertsFromPEM(file)\n+\treturn certPool, nil\n+}\n+\n+// Client returns a TLS configuration meant to be used by a client.\n+func Client(enable, verify bool, ca, cert, key string) (*tls.Config, error) {\n+\tif !enable {","path":"pkg/tlsconfig/config.go","position":49,"original_position":49,"commit_id":"13e669e112e8284c85137fc772bb49558265ab4d","original_commit_id":"13e669e112e8284c85137fc772bb49558265ab4d","user":{"login":"LK4D4","id":101445,"avatar_url":"https://avatars.githubusercontent.com/u/101445?v=3","gravatar_id":"","url":"https://api.github.com/users/LK4D4","html_url":"https://github.com/LK4D4","followers_url":"https://api.github.com/users/LK4D4/followers","following_url":"https://api.github.com/users/LK4D4/following{/other_user}","gists_url":"https://api.github.com/users/LK4D4/gists{/gist_id}","starred_url":"https://api.github.com/users/LK4D4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LK4D4/subscriptions","organizations_url":"https://api.github.com/users/LK4D4/orgs","repos_url":"https://api.github.com/users/LK4D4/repos","events_url":"https://api.github.com/users/LK4D4/events{/privacy}","received_events_url":"https://api.github.com/users/LK4D4/received_events","type":"User","site_admin":false},"body":"I don't know. This looks bad, like you try to just split current code and not create good package. I'm not sure that such things should be in `pkg/`.","created_at":"2015-06-01T22:12:24Z","updated_at":"2015-06-01T22:12:24Z","html_url":"https://github.com/docker/docker/pull/13636#discussion_r31476202","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/13636","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/31476202"},"html":{"href":"https://github.com/docker/docker/pull/13636#discussion_r31476202"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/13636"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/13636","id":36651564,"html_url":"https://github.com/docker/docker/pull/13636","diff_url":"https://github.com/docker/docker/pull/13636.diff","patch_url":"https://github.com/docker/docker/pull/13636.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/13636","number":13636,"state":"open","locked":false,"title":"Refactor TLS code with a new `tlsconfig` package","user":{"login":"tiborvass","id":827131,"avatar_url":"https://avatars.githubusercontent.com/u/827131?v=3","gravatar_id":"","url":"https://api.github.com/users/tiborvass","html_url":"https://github.com/tiborvass","followers_url":"https://api.github.com/users/tiborvass/followers","following_url":"https://api.github.com/users/tiborvass/following{/other_user}","gists_url":"https://api.github.com/users/tiborvass/gists{/gist_id}","starred_url":"https://api.github.com/users/tiborvass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiborvass/subscriptions","organizations_url":"https://api.github.com/users/tiborvass/orgs","repos_url":"https://api.github.com/users/tiborvass/repos","events_url":"https://api.github.com/users/tiborvass/events{/privacy}","received_events_url":"https://api.github.com/users/tiborvass/received_events","type":"User","site_admin":false},"body":"This patch creates a new `tlsconfig` package to handle creation of\r\nsecure-enough TLS configurations for clients and servers.\r\n\r\nThe package was created by refactoring TLS code in the client and the\r\ndaemon. After this patch, it is expected that all code creating TLS\r\nconfigurations use this `tlsconfig` package for greater security,\r\nconsistency and readability.\r\n\r\nSigned-off-by: Tibor Vass <tibor@docker.com>\r\n\r\n=========\r\n\r\nNote: this patch does not modify code under `registry/` although it is expected for other patches touching code that creates TLS configurations (including `registry/`), to reuse this `tlsconfig` package.\r\n\r\nPing @diogomonica @NathanMcCauley @dmcgowan @docker/core-maintainers ","created_at":"2015-06-01T17:34:39Z","updated_at":"2015-06-01T22:12:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":"caa42f20fa608cd4c5cfe7d1ddcd16609e24050b","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/docker/pulls/13636/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/13636/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/13636/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/13e669e112e8284c85137fc772bb49558265ab4d","head":{"label":"tiborvass:refactor-tls","ref":"refactor-tls","sha":"13e669e112e8284c85137fc772bb49558265ab4d","user":{"login":"tiborvass","id":827131,"avatar_url":"https://avatars.githubusercontent.com/u/827131?v=3","gravatar_id":"","url":"https://api.github.com/users/tiborvass","html_url":"https://github.com/tiborvass","followers_url":"https://api.github.com/users/tiborvass/followers","following_url":"https://api.github.com/users/tiborvass/following{/other_user}","gists_url":"https://api.github.com/users/tiborvass/gists{/gist_id}","starred_url":"https://api.github.com/users/tiborvass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiborvass/subscriptions","organizations_url":"https://api.github.com/users/tiborvass/orgs","repos_url":"https://api.github.com/users/tiborvass/repos","events_url":"https://api.github.com/users/tiborvass/events{/privacy}","received_events_url":"https://api.github.com/users/tiborvass/received_events","type":"User","site_admin":false},"repo":{"id":16678776,"name":"docker","full_name":"tiborvass/docker","owner":{"login":"tiborvass","id":827131,"avatar_url":"https://avatars.githubusercontent.com/u/827131?v=3","gravatar_id":"","url":"https://api.github.com/users/tiborvass","html_url":"https://github.com/tiborvass","followers_url":"https://api.github.com/users/tiborvass/followers","following_url":"https://api.github.com/users/tiborvass/following{/other_user}","gists_url":"https://api.github.com/users/tiborvass/gists{/gist_id}","starred_url":"https://api.github.com/users/tiborvass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tiborvass/subscriptions","organizations_url":"https://api.github.com/users/tiborvass/orgs","repos_url":"https://api.github.com/users/tiborvass/repos","events_url":"https://api.github.com/users/tiborvass/events{/privacy}","received_events_url":"https://api.github.com/users/tiborvass/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/tiborvass/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/tiborvass/docker","forks_url":"https://api.github.com/repos/tiborvass/docker/forks","keys_url":"https://api.github.com/repos/tiborvass/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tiborvass/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tiborvass/docker/teams","hooks_url":"https://api.github.com/repos/tiborvass/docker/hooks","issue_events_url":"https://api.github.com/repos/tiborvass/docker/issues/events{/number}","events_url":"https://api.github.com/repos/tiborvass/docker/events","assignees_url":"https://api.github.com/repos/tiborvass/docker/assignees{/user}","branches_url":"https://api.github.com/repos/tiborvass/docker/branches{/branch}","tags_url":"https://api.github.com/repos/tiborvass/docker/tags","blobs_url":"https://api.github.com/repos/tiborvass/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tiborvass/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tiborvass/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/tiborvass/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tiborvass/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/tiborvass/docker/languages","stargazers_url":"https://api.github.com/repos/tiborvass/docker/stargazers","contributors_url":"https://api.github.com/repos/tiborvass/docker/contributors","subscribers_url":"https://api.github.com/repos/tiborvass/docker/subscribers","subscription_url":"https://api.github.com/repos/tiborvass/docker/subscription","commits_url":"https://api.github.com/repos/tiborvass/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/tiborvass/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/tiborvass/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/tiborvass/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/tiborvass/docker/contents/{+path}","compare_url":"https://api.github.com/repos/tiborvass/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tiborvass/docker/merges","archive_url":"https://api.github.com/repos/tiborvass/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tiborvass/docker/downloads","issues_url":"https://api.github.com/repos/tiborvass/docker/issues{/number}","pulls_url":"https://api.github.com/repos/tiborvass/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/tiborvass/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/tiborvass/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tiborvass/docker/labels{/name}","releases_url":"https://api.github.com/repos/tiborvass/docker/releases{/id}","created_at":"2014-02-09T23:31:28Z","updated_at":"2014-07-24T21:22:38Z","pushed_at":"2015-06-01T21:50:15Z","git_url":"git://github.com/tiborvass/docker.git","ssh_url":"git@github.com:tiborvass/docker.git","clone_url":"https://github.com/tiborvass/docker.git","svn_url":"https://github.com/tiborvass/docker","homepage":"http://www.docker.io","size":58722,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"64a74316634b75dd406673ebaba15eb2bbd96d11","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2015-06-01T20:31:49Z","pushed_at":"2015-06-01T22:05:34Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":222453,"stargazers_count":22060,"watchers_count":22060,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":5248,"mirror_url":null,"open_issues_count":1026,"forks":5248,"open_issues":1026,"watchers":22060,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/13636"},"html":{"href":"https://github.com/docker/docker/pull/13636"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/13636"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/13636/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/13636/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/13636/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/13e669e112e8284c85137fc772bb49558265ab4d"}}}}