{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14546","labels_url":"https://api.github.com/repos/docker/docker/issues/14546/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14546/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14546/events","html_url":"https://github.com/docker/docker/pull/14546","id":94418012,"number":14546,"title":"Notary integration","user":{"login":"dmcgowan","id":169601,"avatar_url":"https://avatars.githubusercontent.com/u/169601?v=3","gravatar_id":"","url":"https://api.github.com/users/dmcgowan","html_url":"https://github.com/dmcgowan","followers_url":"https://api.github.com/users/dmcgowan/followers","following_url":"https://api.github.com/users/dmcgowan/following{/other_user}","gists_url":"https://api.github.com/users/dmcgowan/gists{/gist_id}","starred_url":"https://api.github.com/users/dmcgowan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmcgowan/subscriptions","organizations_url":"https://api.github.com/users/dmcgowan/orgs","repos_url":"https://api.github.com/users/dmcgowan/repos","events_url":"https://api.github.com/users/dmcgowan/events{/privacy}","received_events_url":"https://api.github.com/users/dmcgowan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/39","html_url":"https://github.com/docker/docker/milestones/1.8.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/39/labels","id":1151952,"number":39,"title":"1.8.0","description":"","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":26,"state":"open","created_at":"2015-06-05T19:27:06Z","updated_at":"2015-07-20T21:35:22Z","due_on":"2015-08-09T22:00:00Z","closed_at":null},"comments":30,"created_at":"2015-07-11T00:22:01Z","updated_at":"2015-07-20T22:17:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14546","html_url":"https://github.com/docker/docker/pull/14546","diff_url":"https://github.com/docker/docker/pull/14546.diff","patch_url":"https://github.com/docker/docker/pull/14546.patch"},"body":"# Summary\r\nAdd support for trusted image distribution through the use of notary. Notary logic is done client side to allow cli users full configuration of trust and limiting access to private keys to user's machine. Trusted cli actions which involve pulling will always do a pull by digest to the daemon. Since the daemon already supports pull by digest, no changes to the daemon are needed to support the use of notary. All signatures will be done directly from the client on push. For more details on the design, see the [design document](https://docs.google.com/document/d/1Xn9kuhICOFj_P37ZWng8LeR_32NAj4Ytm42XAVWuTHw/edit#).\r\n\r\n# UX Changes\r\n## Flags\r\n - `--untrusted` - Explicitly run a pull or push action as untrusted. Defaults to true in 1.7. This can be used to override the `DOCKER_NOTARY` environment variable.\r\n\r\n## Trusted Mode\r\n### Pull Changes\r\n\r\n#### Pull by digest\r\nThe initial pull line will now always include the digest of the image being pulled.\r\n\r\n#### Sequential pull all\r\nWhen pulling multiple tags, the client will now sequentially call a pull by digest on every tag.\r\n\r\n#### Full sample pull output\r\n```\r\nExpanded name to docker.io/dmcgowan/myapp\r\nPull (1 of 1): dmcgowan/myapp:latest@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8\r\nsha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8: Pulling from dmcgowan/myapp\r\na8219747be10: Already exists \r\n91c95931e552: Already exists \r\nDigest: sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8\r\nStatus: Downloaded newer image for dmcgowan/myapp@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8\r\nTagging dmcgowan/myapp@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8 as dmcgowan/myapp:latest\r\n```\r\n\r\n### Push Changes\r\n#### Status Line\r\nPush status line which displays digest now shows tag, digest, and size. This was used for client to be able to parse from the output what the pushed manifests were. These output lines represent the changes which will be made to the notary repository.\r\n\r\nold\r\n```\r\nDigest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118\r\n```\r\nnew\r\n```\r\nlatest: digest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118 size: 10115\r\n```\r\n\r\n#### Passphrase prompt on first push of repository\r\nWhen a repository is pushed for the first time the cli will be prompted for a passphrase. The passphrase will not be echoed back to the user. If metadata is near expiration time, the passphrase may be prompted again to re-sign the metadata. Subsequent pushes should not require entering a passphrase. If entering in a passphrase is not desirable, then the `notary` tool may be used directly to initialize a repository.\r\n\r\n#### Full sample push output\r\n```\r\nThe push refers to a repository [dmcgowan/myapp] (len: 1)\r\n91c95931e552: Image already exists \r\na8219747be10: Image already exists \r\nlatest: digest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118 size: 10115\r\nSigning and pushing TUF metadata\r\nExpanded name to docker.io/dmcgowan/myapp\r\nLoading trusted collection.\r\nCreating a new private key\r\nPassphrase:\r\nSaving changes to Trusted Collection.\r\nFinished initializing \"docker.io/dmcgowan/myapp\"\r\nLoading trusted collection.\r\n```\r\n\r\n## Environment Variables\r\n - `DOCKER_NOTARY` - boolean whether to use Notary in Docker\r\n - `NOTARY_SERVER` - Notary server to use for all repositories\r\n\r\n# Remaining items for code review\r\n - [x] Authentication integration with distribution client (need to solve problem with FQDN support)\r\n - [x] Load Certificates from ~/.docker/tls/<hostname>\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/123068680","html_url":"https://github.com/docker/docker/pull/14546#issuecomment-123068680","issue_url":"https://api.github.com/repos/docker/docker/issues/14546","id":123068680,"user":{"login":"jfrazelle","id":1445228,"avatar_url":"https://avatars.githubusercontent.com/u/1445228?v=3","gravatar_id":"","url":"https://api.github.com/users/jfrazelle","html_url":"https://github.com/jfrazelle","followers_url":"https://api.github.com/users/jfrazelle/followers","following_url":"https://api.github.com/users/jfrazelle/following{/other_user}","gists_url":"https://api.github.com/users/jfrazelle/gists{/gist_id}","starred_url":"https://api.github.com/users/jfrazelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfrazelle/subscriptions","organizations_url":"https://api.github.com/users/jfrazelle/orgs","repos_url":"https://api.github.com/users/jfrazelle/repos","events_url":"https://api.github.com/users/jfrazelle/events{/privacy}","received_events_url":"https://api.github.com/users/jfrazelle/received_events","type":"User","site_admin":false},"created_at":"2015-07-20T22:17:20Z","updated_at":"2015-07-20T22:17:20Z","body":"Hmmm I don't like the idea of a hidden for for rewrites this has gone too far\n\n> On Jul 20, 2015, at 13:07, David Calavera <notifications@github.com> wrote:\n> \n> The problem with my implementation is that the new Dockerfile must always be inside the absolute root context, so we might need to create a hidden directory there, something like .docker-trust?\n> \n> https://github.com/dmcgowan/docker/blob/b798c6b483ec82e6858f0324c382b66b72e64334/api/client/build.go#L151\n> \n> —\n> Reply to this email directly or view it on GitHub.\n> \n"}}