{"action":"created","comment":{"url":"https://api.github.com/repos/docker/notary/pulls/comments/33647626","id":33647626,"diff_hunk":"@@ -461,6 +464,77 @@ func bootstrapClient(remote store.RemoteStore, repo *tuf.TufRepo, kdb *keys.KeyD\n \t), nil\n }\n \n+/*\n+validateRoot iterates over every root key included in the TUF data and attempts\n+to validate the certificate by first checking for an exact match on the certificate\n+store, and subsequently trying to find a valid chain on the caStore.\n+\n+Example TUF Content for root role:\n+\"roles\" : {\n+  \"root\" : {\n+    \"threshold\" : 1,\n+      \"keyids\" : [\n+        \"e6da5c303d572712a086e669ecd4df7b785adfc844e0c9a7b1f21a7dfc477a38\"\n+      ]\n+  },\n+ ...\n+}\n+\n+Example TUF Content for root key:\n+\"e6da5c303d572712a086e669ecd4df7b785adfc844e0c9a7b1f21a7dfc477a38\" : {\n+\t\"keytype\" : \"RSA\",\n+\t\"keyval\" : {\n+\t  \"private\" : \"\",\n+\t  \"public\" : \"Base64-encoded, PEM encoded x509 Certificate\"\n+\t}\n+}\n+*/\n+func validateRoot(gun string, root *data.Signed) error {\n+\trootSigned := &data.Root{}\n+\terr := json.Unmarshal(root.Signed, rootSigned)\n+\tif err != nil {\n+\t\treturn err\n+\t}\n+\tcerts := make(map[string]*data.PublicKey)\n+\tfor _, kID := range rootSigned.Roles[\"root\"].KeyIDs {\n+\t\t// TODO(dlaw): currently assuming only one cert contained in\n+\t\t// public key entry. Need to fix when we want to pass in chains.\n+\t\tk, _ := pem.Decode([]byte(rootSigned.Keys[\"kid\"].Public()))","path":"cmd/notary/tuf.go","position":null,"original_position":106,"commit_id":"a026f92a0b6f842ccb16fb3fc25299845c3e88c0","original_commit_id":"a0e63bcaeb91fc05d81c232ce9335d1effd9eff9","user":{"login":"endophage","id":1302091,"avatar_url":"https://avatars.githubusercontent.com/u/1302091?v=3","gravatar_id":"","url":"https://api.github.com/users/endophage","html_url":"https://github.com/endophage","followers_url":"https://api.github.com/users/endophage/followers","following_url":"https://api.github.com/users/endophage/following{/other_user}","gists_url":"https://api.github.com/users/endophage/gists{/gist_id}","starred_url":"https://api.github.com/users/endophage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/endophage/subscriptions","organizations_url":"https://api.github.com/users/endophage/orgs","repos_url":"https://api.github.com/users/endophage/repos","events_url":"https://api.github.com/users/endophage/events{/privacy}","received_events_url":"https://api.github.com/users/endophage/received_events","type":"User","site_admin":false},"body":"Ah, nevermind then. Saw the `_` and assumed I was skipping a check when I put that in. Not familiar enough with the pem lib.","created_at":"2015-07-01T04:35:55Z","updated_at":"2015-07-01T04:35:55Z","html_url":"https://github.com/docker/notary/pull/8#discussion_r33647626","pull_request_url":"https://api.github.com/repos/docker/notary/pulls/8","_links":{"self":{"href":"https://api.github.com/repos/docker/notary/pulls/comments/33647626"},"html":{"href":"https://github.com/docker/notary/pull/8#discussion_r33647626"},"pull_request":{"href":"https://api.github.com/repos/docker/notary/pulls/8"}}},"pull_request":{"url":"https://api.github.com/repos/docker/notary/pulls/8","id":38176720,"html_url":"https://github.com/docker/notary/pull/8","diff_url":"https://github.com/docker/notary/pull/8.diff","patch_url":"https://github.com/docker/notary/pull/8.patch","issue_url":"https://api.github.com/repos/docker/notary/issues/8","number":8,"state":"open","locked":false,"title":"validate root file against cert store","user":{"login":"endophage","id":1302091,"avatar_url":"https://avatars.githubusercontent.com/u/1302091?v=3","gravatar_id":"","url":"https://api.github.com/users/endophage","html_url":"https://github.com/endophage","followers_url":"https://api.github.com/users/endophage/followers","following_url":"https://api.github.com/users/endophage/following{/other_user}","gists_url":"https://api.github.com/users/endophage/gists{/gist_id}","starred_url":"https://api.github.com/users/endophage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/endophage/subscriptions","organizations_url":"https://api.github.com/users/endophage/orgs","repos_url":"https://api.github.com/users/endophage/repos","events_url":"https://api.github.com/users/endophage/events{/privacy}","received_events_url":"https://api.github.com/users/endophage/received_events","type":"User","site_admin":false},"body":"As part of bootstrapping a TUF client, validate the downloaded root.json against our cert store. Per conversation with @NathanMcCauley the logic is as follows:\r\n\r\n1. Parse root.json\r\n2. Read Key IDs associated with the root role.\r\n3. Read keys (from the root.json) associated with the root role key IDs.\r\n4. Validate keys from root.json against local cert pool.\r\n5. Using only keys that validated against cert pool, validate signatures on the root.json, requiring a threshold of 1.","created_at":"2015-06-21T00:12:15Z","updated_at":"2015-07-01T04:35:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0032ab8cc2b978b8dca05747732b22fa6bf701f8","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/notary/pulls/8/commits","review_comments_url":"https://api.github.com/repos/docker/notary/pulls/8/comments","review_comment_url":"https://api.github.com/repos/docker/notary/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/notary/issues/8/comments","statuses_url":"https://api.github.com/repos/docker/notary/statuses/a026f92a0b6f842ccb16fb3fc25299845c3e88c0","head":{"label":"docker:validate_root","ref":"validate_root","sha":"a026f92a0b6f842ccb16fb3fc25299845c3e88c0","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":37743436,"name":"notary","full_name":"docker/notary","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/notary","description":"","fork":false,"url":"https://api.github.com/repos/docker/notary","forks_url":"https://api.github.com/repos/docker/notary/forks","keys_url":"https://api.github.com/repos/docker/notary/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/notary/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/notary/teams","hooks_url":"https://api.github.com/repos/docker/notary/hooks","issue_events_url":"https://api.github.com/repos/docker/notary/issues/events{/number}","events_url":"https://api.github.com/repos/docker/notary/events","assignees_url":"https://api.github.com/repos/docker/notary/assignees{/user}","branches_url":"https://api.github.com/repos/docker/notary/branches{/branch}","tags_url":"https://api.github.com/repos/docker/notary/tags","blobs_url":"https://api.github.com/repos/docker/notary/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/notary/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/notary/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/notary/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/notary/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/notary/languages","stargazers_url":"https://api.github.com/repos/docker/notary/stargazers","contributors_url":"https://api.github.com/repos/docker/notary/contributors","subscribers_url":"https://api.github.com/repos/docker/notary/subscribers","subscription_url":"https://api.github.com/repos/docker/notary/subscription","commits_url":"https://api.github.com/repos/docker/notary/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/notary/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/notary/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/notary/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/notary/contents/{+path}","compare_url":"https://api.github.com/repos/docker/notary/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/notary/merges","archive_url":"https://api.github.com/repos/docker/notary/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/notary/downloads","issues_url":"https://api.github.com/repos/docker/notary/issues{/number}","pulls_url":"https://api.github.com/repos/docker/notary/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/notary/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/notary/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/notary/labels{/name}","releases_url":"https://api.github.com/repos/docker/notary/releases{/id}","created_at":"2015-06-19T20:07:53Z","updated_at":"2015-07-01T03:06:45Z","pushed_at":"2015-07-01T04:34:02Z","git_url":"git://github.com/docker/notary.git","ssh_url":"git@github.com:docker/notary.git","clone_url":"https://github.com/docker/notary.git","svn_url":"https://github.com/docker/notary","homepage":null,"size":18148,"stargazers_count":263,"watchers_count":263,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":14,"mirror_url":null,"open_issues_count":15,"forks":14,"open_issues":15,"watchers":263,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"908378c5cac4ccf52e9fd8430e52643c40492c43","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":37743436,"name":"notary","full_name":"docker/notary","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/notary","description":"","fork":false,"url":"https://api.github.com/repos/docker/notary","forks_url":"https://api.github.com/repos/docker/notary/forks","keys_url":"https://api.github.com/repos/docker/notary/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/notary/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/notary/teams","hooks_url":"https://api.github.com/repos/docker/notary/hooks","issue_events_url":"https://api.github.com/repos/docker/notary/issues/events{/number}","events_url":"https://api.github.com/repos/docker/notary/events","assignees_url":"https://api.github.com/repos/docker/notary/assignees{/user}","branches_url":"https://api.github.com/repos/docker/notary/branches{/branch}","tags_url":"https://api.github.com/repos/docker/notary/tags","blobs_url":"https://api.github.com/repos/docker/notary/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/notary/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/notary/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/notary/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/notary/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/notary/languages","stargazers_url":"https://api.github.com/repos/docker/notary/stargazers","contributors_url":"https://api.github.com/repos/docker/notary/contributors","subscribers_url":"https://api.github.com/repos/docker/notary/subscribers","subscription_url":"https://api.github.com/repos/docker/notary/subscription","commits_url":"https://api.github.com/repos/docker/notary/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/notary/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/notary/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/notary/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/notary/contents/{+path}","compare_url":"https://api.github.com/repos/docker/notary/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/notary/merges","archive_url":"https://api.github.com/repos/docker/notary/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/notary/downloads","issues_url":"https://api.github.com/repos/docker/notary/issues{/number}","pulls_url":"https://api.github.com/repos/docker/notary/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/notary/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/notary/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/notary/labels{/name}","releases_url":"https://api.github.com/repos/docker/notary/releases{/id}","created_at":"2015-06-19T20:07:53Z","updated_at":"2015-07-01T03:06:45Z","pushed_at":"2015-07-01T04:34:02Z","git_url":"git://github.com/docker/notary.git","ssh_url":"git@github.com:docker/notary.git","clone_url":"https://github.com/docker/notary.git","svn_url":"https://github.com/docker/notary","homepage":null,"size":18148,"stargazers_count":263,"watchers_count":263,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":14,"mirror_url":null,"open_issues_count":15,"forks":14,"open_issues":15,"watchers":263,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/notary/pulls/8"},"html":{"href":"https://github.com/docker/notary/pull/8"},"issue":{"href":"https://api.github.com/repos/docker/notary/issues/8"},"comments":{"href":"https://api.github.com/repos/docker/notary/issues/8/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/notary/pulls/8/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/notary/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/notary/pulls/8/commits"},"statuses":{"href":"https://api.github.com/repos/docker/notary/statuses/a026f92a0b6f842ccb16fb3fc25299845c3e88c0"}}}}