{"push_id":1035125495,"size":1,"distinct_size":1,"ref":"refs/heads/cert-rotation","head":"7a67f6b85c223912302626ab7b31a5195294abfc","before":"d69103f6beec9cddc71fb553a18683f2448e27bc","commits":[{"sha":"7a67f6b85c223912302626ab7b31a5195294abfc","author":{"email":"f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com","name":"Ying Li"},"message":"Change root signing such that when root keys change, the role is stored as a\nversioned root role in the root.json.  That way we can figure out which keys were\npreviously root keys.\n\nUpdate tuf.Repo.sign to take a list of required roles (at most two, for root\nrotations, because only the immediate root after a rotation absolutely needs\nto correctly validate against the previous root role and the new root role)\ninstead of just a single role.\n\ntuf.Repo.sign now ensures that the number of signatures on the metadata satisfy\nrole requirements for every required role.  Then it tries to sign with\nwhatever optional keys it can, ignoring errors and not requiring that any\nnumber signatures were produced with the optional keys.\n\nSigned-off-by: Ying Li <ying.li@docker.com>","distinct":true,"url":"https://api.github.com/repos/cyli/notary/commits/7a67f6b85c223912302626ab7b31a5195294abfc"}]}