{"action":"created","comment":{"url":"https://api.github.com/repos/docker/notary/pulls/comments/58779745","id":58779745,"diff_hunk":"@@ -159,6 +166,51 @@ func (c *certCommander) certRemove(cmd *cobra.Command, args []string) error {\n \treturn nil\n }\n \n+// certRotate replaces a certificate with a new version\n+func (c *certCommander) certRotate(cmd *cobra.Command, args []string) error {","path":"cmd/notary/cert.go","position":26,"original_position":26,"commit_id":"083793b21b9226259c5fda835a9db741240018c3","original_commit_id":"083793b21b9226259c5fda835a9db741240018c3","user":{"login":"endophage","id":1302091,"avatar_url":"https://avatars.githubusercontent.com/u/1302091?v=3","gravatar_id":"","url":"https://api.github.com/users/endophage","html_url":"https://github.com/endophage","followers_url":"https://api.github.com/users/endophage/followers","following_url":"https://api.github.com/users/endophage/following{/other_user}","gists_url":"https://api.github.com/users/endophage/gists{/gist_id}","starred_url":"https://api.github.com/users/endophage/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/endophage/subscriptions","organizations_url":"https://api.github.com/users/endophage/orgs","repos_url":"https://api.github.com/users/endophage/repos","events_url":"https://api.github.com/users/endophage/events{/privacy}","received_events_url":"https://api.github.com/users/endophage/received_events","type":"User","site_admin":false},"body":"This appears to always rotate all root keys (or possibly all those for which we hold the private key?). Is that the behaviour we want?","created_at":"2016-04-06T20:52:18Z","updated_at":"2016-04-06T20:52:18Z","html_url":"https://github.com/docker/notary/pull/648#discussion_r58779745","pull_request_url":"https://api.github.com/repos/docker/notary/pulls/648","_links":{"self":{"href":"https://api.github.com/repos/docker/notary/pulls/comments/58779745"},"html":{"href":"https://github.com/docker/notary/pull/648#discussion_r58779745"},"pull_request":{"href":"https://api.github.com/repos/docker/notary/pulls/648"}}},"pull_request":{"url":"https://api.github.com/repos/docker/notary/pulls/648","id":63991073,"html_url":"https://github.com/docker/notary/pull/648","diff_url":"https://github.com/docker/notary/pull/648.diff","patch_url":"https://github.com/docker/notary/pull/648.patch","issue_url":"https://api.github.com/repos/docker/notary/issues/648","number":648,"state":"open","locked":false,"title":"Cert rotation, redux","user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"body":"This is the rebased version + some changes from https://github.com/docker/notary/pull/267.\r\n\r\nTo summarize:  that PR added library support and CLI support for rotating the public x509 root public key in a root.json, in case it expires.  This does not rotate the root private key.\r\n\r\nThere are a couple additional commits that address some comments from the previous PR:\r\n\r\n1.  https://github.com/docker/notary/pull/267#discussion_r51491390 and https://github.com/docker/notary/pull/267#discussion_r51491941: MultiSigning support - currently, notary attempts to support theoretical multisigning, and we would like to preserve this as we would like to implement threshold support for root keys in the near-ish future.  However, @mtrmac is correct in that currently, there is no recommended mechanism or any infrastructure in place to handle that.  So this PR punts determination of how many signatures are needed up to `tuf.Repo`'s `SignRoot`, which right now requires that the threshold signatures be met for every required role.\r\n\r\n2. https://github.com/docker/notary/pull/267#discussion_r48772435, https://github.com/docker/notary/pull/267#discussion_r51492254, https://github.com/docker/notary/pull/267#discussion_r51492399:  Record of old keys - this maintains the old public keys in the `tuf.Repo.Root.Signed.Keys` object, but there is otherwise no way in spec to keep track of which of those keys are actually old keys, vs cruft.  This PR adds versioned root roles every time root keys are changed to the list of roles in `tuf.Repo.Root.Signed.Roles` - this technically does not violate the spec, because it doesn't change existing roles, and is not used for validation, only hints w.r.t. which keys to use for signing.  It may also be helpful in maintaining a history of root key changes).\r\n\r\nThis is probably ready for first look.  @mtrmac?","created_at":"2016-03-24T05:16:07Z","updated_at":"2016-04-06T20:52:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"04a6e93605ff1104631416a5e6488485c9b73b76","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/notary/pulls/648/commits","review_comments_url":"https://api.github.com/repos/docker/notary/pulls/648/comments","review_comment_url":"https://api.github.com/repos/docker/notary/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/notary/issues/648/comments","statuses_url":"https://api.github.com/repos/docker/notary/statuses/083793b21b9226259c5fda835a9db741240018c3","head":{"label":"cyli:cert-rotation","ref":"cert-rotation","sha":"083793b21b9226259c5fda835a9db741240018c3","user":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"repo":{"id":43714589,"name":"notary","full_name":"cyli/notary","owner":{"login":"cyli","id":223200,"avatar_url":"https://avatars.githubusercontent.com/u/223200?v=3","gravatar_id":"","url":"https://api.github.com/users/cyli","html_url":"https://github.com/cyli","followers_url":"https://api.github.com/users/cyli/followers","following_url":"https://api.github.com/users/cyli/following{/other_user}","gists_url":"https://api.github.com/users/cyli/gists{/gist_id}","starred_url":"https://api.github.com/users/cyli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyli/subscriptions","organizations_url":"https://api.github.com/users/cyli/orgs","repos_url":"https://api.github.com/users/cyli/repos","events_url":"https://api.github.com/users/cyli/events{/privacy}","received_events_url":"https://api.github.com/users/cyli/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cyli/notary","description":"","fork":true,"url":"https://api.github.com/repos/cyli/notary","forks_url":"https://api.github.com/repos/cyli/notary/forks","keys_url":"https://api.github.com/repos/cyli/notary/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cyli/notary/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cyli/notary/teams","hooks_url":"https://api.github.com/repos/cyli/notary/hooks","issue_events_url":"https://api.github.com/repos/cyli/notary/issues/events{/number}","events_url":"https://api.github.com/repos/cyli/notary/events","assignees_url":"https://api.github.com/repos/cyli/notary/assignees{/user}","branches_url":"https://api.github.com/repos/cyli/notary/branches{/branch}","tags_url":"https://api.github.com/repos/cyli/notary/tags","blobs_url":"https://api.github.com/repos/cyli/notary/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cyli/notary/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cyli/notary/git/refs{/sha}","trees_url":"https://api.github.com/repos/cyli/notary/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cyli/notary/statuses/{sha}","languages_url":"https://api.github.com/repos/cyli/notary/languages","stargazers_url":"https://api.github.com/repos/cyli/notary/stargazers","contributors_url":"https://api.github.com/repos/cyli/notary/contributors","subscribers_url":"https://api.github.com/repos/cyli/notary/subscribers","subscription_url":"https://api.github.com/repos/cyli/notary/subscription","commits_url":"https://api.github.com/repos/cyli/notary/commits{/sha}","git_commits_url":"https://api.github.com/repos/cyli/notary/git/commits{/sha}","comments_url":"https://api.github.com/repos/cyli/notary/comments{/number}","issue_comment_url":"https://api.github.com/repos/cyli/notary/issues/comments{/number}","contents_url":"https://api.github.com/repos/cyli/notary/contents/{+path}","compare_url":"https://api.github.com/repos/cyli/notary/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cyli/notary/merges","archive_url":"https://api.github.com/repos/cyli/notary/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cyli/notary/downloads","issues_url":"https://api.github.com/repos/cyli/notary/issues{/number}","pulls_url":"https://api.github.com/repos/cyli/notary/pulls{/number}","milestones_url":"https://api.github.com/repos/cyli/notary/milestones{/number}","notifications_url":"https://api.github.com/repos/cyli/notary/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cyli/notary/labels{/name}","releases_url":"https://api.github.com/repos/cyli/notary/releases{/id}","deployments_url":"https://api.github.com/repos/cyli/notary/deployments","created_at":"2015-10-05T21:22:52Z","updated_at":"2015-10-05T21:22:54Z","pushed_at":"2016-04-06T20:11:38Z","git_url":"git://github.com/cyli/notary.git","ssh_url":"git@github.com:cyli/notary.git","clone_url":"https://github.com/cyli/notary.git","svn_url":"https://github.com/cyli/notary","homepage":null,"size":25595,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"69a25b8906e2106624382d0535848a73ec943863","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":37743436,"name":"notary","full_name":"docker/notary","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/notary","description":"Notary is a Docker project that allows anyone to have trust over arbitrary collections of data","fork":false,"url":"https://api.github.com/repos/docker/notary","forks_url":"https://api.github.com/repos/docker/notary/forks","keys_url":"https://api.github.com/repos/docker/notary/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/notary/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/notary/teams","hooks_url":"https://api.github.com/repos/docker/notary/hooks","issue_events_url":"https://api.github.com/repos/docker/notary/issues/events{/number}","events_url":"https://api.github.com/repos/docker/notary/events","assignees_url":"https://api.github.com/repos/docker/notary/assignees{/user}","branches_url":"https://api.github.com/repos/docker/notary/branches{/branch}","tags_url":"https://api.github.com/repos/docker/notary/tags","blobs_url":"https://api.github.com/repos/docker/notary/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/notary/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/notary/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/notary/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/notary/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/notary/languages","stargazers_url":"https://api.github.com/repos/docker/notary/stargazers","contributors_url":"https://api.github.com/repos/docker/notary/contributors","subscribers_url":"https://api.github.com/repos/docker/notary/subscribers","subscription_url":"https://api.github.com/repos/docker/notary/subscription","commits_url":"https://api.github.com/repos/docker/notary/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/notary/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/notary/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/notary/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/notary/contents/{+path}","compare_url":"https://api.github.com/repos/docker/notary/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/notary/merges","archive_url":"https://api.github.com/repos/docker/notary/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/notary/downloads","issues_url":"https://api.github.com/repos/docker/notary/issues{/number}","pulls_url":"https://api.github.com/repos/docker/notary/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/notary/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/notary/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/notary/labels{/name}","releases_url":"https://api.github.com/repos/docker/notary/releases{/id}","deployments_url":"https://api.github.com/repos/docker/notary/deployments","created_at":"2015-06-19T20:07:53Z","updated_at":"2016-04-06T15:57:54Z","pushed_at":"2016-04-06T20:51:35Z","git_url":"git://github.com/docker/notary.git","ssh_url":"git@github.com:docker/notary.git","clone_url":"https://github.com/docker/notary.git","svn_url":"https://github.com/docker/notary","homepage":"https://docker.com","size":28513,"stargazers_count":600,"watchers_count":600,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":78,"mirror_url":null,"open_issues_count":93,"forks":78,"open_issues":93,"watchers":600,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/notary/pulls/648"},"html":{"href":"https://github.com/docker/notary/pull/648"},"issue":{"href":"https://api.github.com/repos/docker/notary/issues/648"},"comments":{"href":"https://api.github.com/repos/docker/notary/issues/648/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/notary/pulls/648/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/notary/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/notary/pulls/648/commits"},"statuses":{"href":"https://api.github.com/repos/docker/notary/statuses/083793b21b9226259c5fda835a9db741240018c3"}}}}