{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/56755351","id":56755351,"diff_hunk":"@@ -0,0 +1,222 @@\n+<!--[metadata]>\n++++\n+title = \"Delegations for content trust\"\n+description = \"Delegations for content trust\"\n+keywords = [\"trust, security, delegations, keys, repository\"]\n+[menu.main]\n+parent= \"smn_content_trust\"\n++++\n+<![end-metadata]-->\n+\n+# Delegations for content trust\n+\n+Docker Engine 1.10 and above supports the usage of the `targets/releases`\n+delegation as the canonical source of a trusted image tag, if it exists.\n+\n+Using this delegation allows you to collaborate with other publishers without\n+sharing your repository key (a combination of your targets and snapshot keys -\n+please see \"[Manage keys for content trust](trust_key_mng.md)\" for more information).\n+A collaborator can keep their own delegation key private.\n+\n+Delegations are currently an optional feature - in order to set up delegations,\n+you must use the Notary CLI: [download it](https://github.com/docker/notary/releases) and ensure that it is\n+available on your path.\n+\n+For more detailed information about how to use Notary outside of the default\n+Docker Content Trust use cases, please read the\n+[the Notary CLI documentation](https://github.com/docker/notary/blob/master/docs/getting_started.md).\n+\n+Note that when publishing and listing delegation changes using the Notary client,\n+your Docker Hub credentials are required.\n+\n+## Generating delegation keys\n+\n+Your collaborator needs to generate a private key (either RSA or ECDSA)\n+and give you the public key so that you can add it to the `targets/releases`\n+delegation.\n+\n+The easiest way to for them to generate these keys is with OpenSSL.\n+Here is an example of how to generate a 2048-bit RSA portion key (all RSA keys\n+must be at least 2048 bits):\n+\n+```\n+$ opensl genrsa -out delegation.key 2048\n+Generating RSA private key, 2048 bit long modulus\n+....................................................+++\n+............+++\n+e is 65537 (0x10001)\n+\n+```\n+\n+They should keep `delegation.key` private - this is what they will use to sign\n+tags.\n+\n+Then they need to generate a x509 certificate containing the public key, which is\n+what they will give to you.  Here is the command to generate a CSR (certificate\n+signing request):\n+\n+```\n+$ openssl req -new -sha256 -key delegation.key -out delegation.csr\n+```\n+\n+Then they can send it to whichever CA you trust to sign certificates, or they\n+can self-sign the certificate (in this example, creating a certificate that is\n+valid for 1 year):\n+\n+```\n+$ openssl x509 -req -days 365 -in delegation.csr -signkey delegation.key -out delegation.crt\n+```\n+\n+Then they need to give you `delegation.crt`, whether it is self-signed or signed\n+by a CA.\n+\n+## Adding a delegation key to an existing repository\n+\n+Prior to Docker Engine 1.11, the snapshot key was generated and managed locally.\n+Before adding any delegations, you should rotate the snapshot key to the server\n+so that collaborators will not require your snapshot key to sign and publish tags:\n+\n+```\n+$ notary -d ~/.docker/trust key rotate docker.io/<username>/<imagename> snapshot -r\n+```\n+\n+This tells Notary to rotate a key for your particular image repository - note that\n+you must include the `docker.io/` prefix.  `-d ~/.docker/trust` tells Notary where your\n+local Content Trust data is, and `snapshot -r` specifies that you want to rotate\n+the snapshot key specifically, and you want the server to manage it (`-r`\n+stands for \"remote\").\n+","path":"docs/security/trust/trust_delegation.md","position":88,"original_position":88,"commit_id":"44f8c5aaa7953e509452246628293c467da85164","original_commit_id":"44f8c5aaa7953e509452246628293c467da85164","user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"body":"If you want to set up delegations, this is required unless the repo was created with 1.11.","created_at":"2016-03-19T21:25:34Z","updated_at":"2016-03-19T21:25:34Z","html_url":"https://github.com/docker/docker/pull/21046#discussion_r56755351","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/21046","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/56755351"},"html":{"href":"https://github.com/docker/docker/pull/21046#discussion_r56755351"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/21046"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/21046","id":62163330,"html_url":"https://github.com/docker/docker/pull/21046","diff_url":"https://github.com/docker/docker/pull/21046.diff","patch_url":"https://github.com/docker/docker/pull/21046.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/21046","number":21046,"state":"open","locked":false,"title":"Sign all first-level delegation roles when doing a trusted push","user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"body":"This PR enables trusted pushes to sign to all top level (\"targets/X\") delegation roles, not just \"targets/releases\", which may enable users to be able to push to their own name-spaced delegation role as well.\r\n\r\nIt updates the repo, finds out which delegation roles the user has keys for, and attempts to add the tag to all of those roles.  If there are no delegation roles, we fall back on the target role as before.\r\n\r\nTo validate the feature, create a repo with docker, and then use the notary CLI as described here to add a delegation:  https://docs.docker.com/notary/advanced_usage/#work-with-delegation-roles.  You can use one of the fixture key pairs.  After publishing using the notary CLI, use trusted push again.\r\n\r\nYou can verify that the target has been added to `~/.docker/trust/tuf/docker.io/username/repo/metadata/targets/releases.json`.  Alternately, do a `docker pull <tag>` of that repo with content trust enabled, and ensure that what gets pulled is the same has as your *second* push.\r\n\r\n![quokka](https://cuteoverload.files.wordpress.com/2016/01/a-very-friendly-quokka-imgur.jpg?w=600&h=600)","created_at":"2016-03-09T00:52:40Z","updated_at":"2016-03-19T21:25:34Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8896d9b83908aec1fe4a4aec41defbf8cc788ea2","assignee":null,"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/49","html_url":"https://github.com/docker/docker/milestones/1.11.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/49/labels","id":1529231,"number":49,"title":"1.11.0","description":"Code freeze / feature freeze 22 March 2016\r\nPlanned release: 12 April 2016\r\n\r\nhttps://github.com/docker/docker/wiki/Engine-1.11.0","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":27,"closed_issues":82,"state":"open","created_at":"2016-01-21T01:33:46Z","updated_at":"2016-03-19T00:21:18Z","due_on":"2016-04-11T07:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/docker/docker/pulls/21046/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/21046/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/21046/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/44f8c5aaa7953e509452246628293c467da85164","head":{"label":"cyli:use-notary-cli","ref":"use-notary-cli","sha":"44f8c5aaa7953e509452246628293c467da85164","user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"repo":{"id":48516901,"name":"docker","full_name":"cyli/docker","owner":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cyli/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/cyli/docker","forks_url":"https://api.github.com/repos/cyli/docker/forks","keys_url":"https://api.github.com/repos/cyli/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cyli/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cyli/docker/teams","hooks_url":"https://api.github.com/repos/cyli/docker/hooks","issue_events_url":"https://api.github.com/repos/cyli/docker/issues/events{/number}","events_url":"https://api.github.com/repos/cyli/docker/events","assignees_url":"https://api.github.com/repos/cyli/docker/assignees{/user}","branches_url":"https://api.github.com/repos/cyli/docker/branches{/branch}","tags_url":"https://api.github.com/repos/cyli/docker/tags","blobs_url":"https://api.github.com/repos/cyli/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cyli/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cyli/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/cyli/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cyli/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/cyli/docker/languages","stargazers_url":"https://api.github.com/repos/cyli/docker/stargazers","contributors_url":"https://api.github.com/repos/cyli/docker/contributors","subscribers_url":"https://api.github.com/repos/cyli/docker/subscribers","subscription_url":"https://api.github.com/repos/cyli/docker/subscription","commits_url":"https://api.github.com/repos/cyli/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/cyli/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/cyli/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/cyli/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/cyli/docker/contents/{+path}","compare_url":"https://api.github.com/repos/cyli/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cyli/docker/merges","archive_url":"https://api.github.com/repos/cyli/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cyli/docker/downloads","issues_url":"https://api.github.com/repos/cyli/docker/issues{/number}","pulls_url":"https://api.github.com/repos/cyli/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/cyli/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/cyli/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cyli/docker/labels{/name}","releases_url":"https://api.github.com/repos/cyli/docker/releases{/id}","deployments_url":"https://api.github.com/repos/cyli/docker/deployments","created_at":"2015-12-24T00:31:18Z","updated_at":"2015-12-24T00:31:28Z","pushed_at":"2016-03-18T23:50:43Z","git_url":"git://github.com/cyli/docker.git","ssh_url":"git@github.com:cyli/docker.git","clone_url":"https://github.com/cyli/docker.git","svn_url":"https://github.com/cyli/docker","homepage":"http://www.docker.com","size":85199,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"06e98f0a5cf59c040e9f753d60f33ba22256d55c","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","deployments_url":"https://api.github.com/repos/docker/docker/deployments","created_at":"2013-01-18T18:10:57Z","updated_at":"2016-03-19T21:19:17Z","pushed_at":"2016-03-19T21:18:35Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":143250,"stargazers_count":29610,"watchers_count":29610,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8318,"mirror_url":null,"open_issues_count":1413,"forks":8318,"open_issues":1413,"watchers":29610,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/21046"},"html":{"href":"https://github.com/docker/docker/pull/21046"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/21046"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/21046/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/21046/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/21046/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/44f8c5aaa7953e509452246628293c467da85164"}}}}