DockerCLI/vendor/github.com/theupdateframework/notary
Sebastiaan van Stijn f3a05eb800
vendor dependencies with go1.17
Some warnings about go1.16 compatibility, so including them here:

     + go mod tidy -modfile=vendor.mod
     github.com/docker/cli/cli/registry/client imports
           github.com/docker/distribution/registry/api/v2 imports
           github.com/gorilla/mux loaded from github.com/gorilla/mux@v1.7.0,
        but go 1.16 would select v1.8.0
     github.com/docker/cli/cli/compose/loader imports
        gopkg.in/yaml.v2 tested by
        gopkg.in/yaml.v2.test imports
        gopkg.in/check.v1 loaded from gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f,
        but go 1.16 would select v1.0.0-20201130134442-10cb98267c6c
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/Shopify/logrus-bugsnag loaded from github.com/Shopify/logrus-bugsnag@v0.0.0-20170309145241-6dbc35f2c30d,
        but go 1.16 would select v0.0.0-20171204204709-577dee27f20d
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server/storage imports
        gopkg.in/rethinkdb/rethinkdb-go.v6 imports
        github.com/opentracing/opentracing-go loaded from github.com/opentracing/opentracing-go@v1.1.0,
        but go 1.16 would select v1.2.0
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server/storage imports
        gopkg.in/rethinkdb/rethinkdb-go.v6 imports
        github.com/opentracing/opentracing-go/ext loaded from github.com/opentracing/opentracing-go@v1.1.0,
        but go 1.16 would select v1.2.0
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server/storage imports
        gopkg.in/rethinkdb/rethinkdb-go.v6 imports
        github.com/opentracing/opentracing-go/log loaded from github.com/opentracing/opentracing-go@v1.1.0,
        but go 1.16 would select v1.2.0
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/spf13/viper imports
        github.com/spf13/afero loaded from github.com/spf13/afero@v1.1.2,
        but go 1.16 would select v1.2.2
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/spf13/viper imports
        github.com/spf13/cast loaded from github.com/spf13/cast@v1.3.0,
        but go 1.16 would select v1.3.1
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/spf13/viper imports
        github.com/spf13/jwalterweatherman loaded from github.com/spf13/jwalterweatherman@v1.0.0,
        but go 1.16 would select v1.1.0
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/spf13/viper imports
        gopkg.in/ini.v1 loaded from gopkg.in/ini.v1@v1.51.0,
        but go 1.16 would select v1.56.0
     github.com/docker/cli/cli/command imports
        github.com/theupdateframework/notary/client tested by
        github.com/theupdateframework/notary/client.test imports
        github.com/theupdateframework/notary/server imports
        github.com/theupdateframework/notary/utils imports
        github.com/spf13/viper imports
        github.com/spf13/afero imports
        github.com/spf13/afero/mem loaded from github.com/spf13/afero@v1.1.2,
        but go 1.16 would select v1.2.2

     To upgrade to the versions selected by go 1.16:
        go mod tidy -go=1.16 && go mod tidy -go=1.17
     If reproducibility with go 1.16 is not needed:
        go mod tidy -compat=1.17
     For other options, see:
        https://golang.org/doc/modules/pruning

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-26 19:48:14 +01:00
..
client vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
cryptoservice vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
passphrase vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
storage vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
trustmanager vendor with go mod 2021-12-16 21:16:01 +01:00
trustpinning vendor with go mod 2021-12-16 21:16:01 +01:00
tuf vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
.gitignore vendor with go mod 2021-12-16 21:16:01 +01:00
CHANGELOG.md vendor with go mod 2021-12-16 21:16:01 +01:00
CODE_OF_CONDUCT.md vendor with go mod 2021-12-16 21:16:01 +01:00
CONTRIBUTING.md vendor with go mod 2021-12-16 21:16:01 +01:00
CONTRIBUTORS vendor with go mod 2021-12-16 21:16:01 +01:00
Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
Jenkinsfile vendor with go mod 2021-12-16 21:16:01 +01:00
LICENSE Move notary to its new location 2017-10-30 17:21:41 +01:00
MAINTAINERS vendor with go mod 2021-12-16 21:16:01 +01:00
MAINTAINERS.ALUMNI vendor with go mod 2021-12-16 21:16:01 +01:00
MAINTAINERS_RULES.md vendor with go mod 2021-12-16 21:16:01 +01:00
Makefile vendor with go mod 2021-12-16 21:16:01 +01:00
NOTARY_VERSION vendor with go mod 2021-12-16 21:16:01 +01:00
README.md vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
codecov.yml vendor with go mod 2021-12-16 21:16:01 +01:00
const.go Move notary to its new location 2017-10-30 17:21:41 +01:00
const_nowindows.go Move notary to its new location 2017-10-30 17:21:41 +01:00
const_windows.go Move notary to its new location 2017-10-30 17:21:41 +01:00
cross.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
development.mysql.yml vendor with go mod 2021-12-16 21:16:01 +01:00
development.postgresql.yml vendor with go mod 2021-12-16 21:16:01 +01:00
development.rethink.yml vendor with go mod 2021-12-16 21:16:01 +01:00
docker-compose.postgresql.yml vendor with go mod 2021-12-16 21:16:01 +01:00
docker-compose.rethink.yml vendor with go mod 2021-12-16 21:16:01 +01:00
docker-compose.yml vendor with go mod 2021-12-16 21:16:01 +01:00
escrow.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
fips.go vendor: github.com/theupdateframework/notary v0.7.0 2021-01-14 16:10:01 +01:00
notary.go Move notary to its new location 2017-10-30 17:21:41 +01:00
server.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
server.minimal.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
signer.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00
signer.minimal.Dockerfile vendor with go mod 2021-12-16 21:16:01 +01:00

README.md

Notary

GoDoc Circle CI CodeCov GoReportCard FOSSA Status

Notice

The Notary project has officially been accepted in to the Cloud Native Computing Foundation (CNCF). It has moved to https://github.com/theupdateframework/notary. Any downstream consumers should update their Go imports to use this new location, which will be the canonical location going forward.

We have moved the repo in GitHub, which will allow existing importers to continue using the old location via GitHub's redirect.

Overview

The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information.

Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS to secure our communications with a web server, which is inherently flawed, as any compromise of the server enables malicious content to be substituted for the legitimate content.

With Notary, publishers can sign their content offline using keys kept highly secure. Once the publisher is ready to make the content available, they can push their signed trusted collection to a Notary Server.

Consumers, having acquired the publisher's public key through a secure channel, can then communicate with any Notary server or (insecure) mirror, relying only on the publisher's key to determine the validity and integrity of the received content.

Goals

Notary is based on The Update Framework, a secure general design for the problem of software distribution and updates. By using TUF, Notary achieves a number of key advantages:

  • Survivable Key Compromise: Content publishers must manage keys in order to sign their content. Signing keys may be compromised or lost so systems must be designed in order to be flexible and recoverable in the case of key compromise. TUF's notion of key roles is utilized to separate responsibilities across a hierarchy of keys such that loss of any particular key (except the root role) by itself is not fatal to the security of the system.
  • Freshness Guarantees: Replay attacks are a common problem in designing secure systems, where previously valid payloads are replayed to trick another system. The same problem exists in the software update systems, where old signed can be presented as the most recent. Notary makes use of timestamping on publishing so that consumers can know that they are receiving the most up to date content. This is particularly important when dealing with software update where old vulnerable versions could be used to attack users.
  • Configurable Trust Thresholds: Oftentimes there are a large number of publishers that are allowed to publish a particular piece of content. For example, open source projects where there are a number of core maintainers. Trust thresholds can be used so that content consumers require a configurable number of signatures on a piece of content in order to trust it. Using thresholds increases security so that loss of individual signing keys doesn't allow publishing of malicious content.
  • Signing Delegation: To allow for flexible publishing of trusted collections, a content publisher can delegate part of their collection to another signer. This delegation is represented as signed metadata so that a consumer of the content can verify both the content and the delegation.
  • Use of Existing Distribution: Notary's trust guarantees are not tied at all to particular distribution channels from which content is delivered. Therefore, trust can be added to any existing content delivery mechanism.
  • Untrusted Mirrors and Transport: All of the notary metadata can be mirrored and distributed via arbitrary channels.

Security

Any security vulnerabilities can be reported to security@docker.com.

See Notary's service architecture docs for more information about our threat model, which details the varying survivability and severities for key compromise as well as mitigations.

Security Audits

Notary has had two public security audits:

Getting started with the Notary CLI

Get the Notary Client CLI binary from the official releases page or you can build one yourself. The version of the Notary server and signer should be greater than or equal to Notary CLI's version to ensure feature compatibility (ex: CLI version 0.2, server/signer version >= 0.2), and all official releases are associated with GitHub tags.

To use the Notary CLI with Docker hub images, have a look at Notary's getting started docs.

For more advanced usage, see the advanced usage docs.

To use the CLI against a local Notary server rather than against Docker Hub:

  1. Ensure that you have docker and docker-compose installed.

  2. git clone https://github.com/theupdateframework/notary.git and from the cloned repository path, start up a local Notary server and signer and copy the config file and testing certs to your local Notary config directory:

    $ docker-compose build
    $ docker-compose up -d
    $ mkdir -p ~/.notary && cp cmd/notary/config.json cmd/notary/root-ca.crt ~/.notary
    
  3. Add 127.0.0.1 notary-server to your /etc/hosts, or if using docker-machine, add $(docker-machine ip) notary-server).

You can run through the examples in the getting started docs and advanced usage docs, but without the -s (server URL) argument to the notary command since the server URL is specified already in the configuration, file you copied.

You can also leave off the -d ~/.docker/trust argument if you do not care to use notary with Docker images.

Upgrading dependencies

To prevent mistakes in vendoring the go modules a buildscript has been added to properly vendor the modules using the correct version of Go to mitigate differences in CI and development environment.

Following procedure should be executed to upgrade a dependency. Preferably keep dependency upgrades in a separate commit from your code changes.

go get -u github.com/spf13/viper
buildscripts/circle-validate-vendor.sh
git add .
git commit -m "Upgraded github.com/spf13/viper"

The buildscripts/circle-validate-vendor.sh runs go mod tidy and go mod vendor using the given version of Go to prevent differences if you are for example running on a different version of Go.

Building Notary

Note that Notary's latest stable release is at the head of the releases branch. The master branch is the development branch and contains features for the next release.

Prerequisites:

  • Go >= 1.12

Set GOPATH. Then, run:

$ export GO111MODULE=on
$ go get github.com/theupdateframework/notary
# build with pkcs11 support by default to support yubikey
$ go install -tags pkcs11 github.com/theupdateframework/notary/cmd/notary
$ notary

To build the server and signer, run docker-compose build.

License

FOSSA Status