Merge pull request #765 from endophage/passphrase_import

moving the passphrase.Retriever definition so fewer things have a cha…
2026-11-05 00:14:17 +03:00 · 2016-06-06 09:47:08 -07:00
parent 1a700552b2 f1b6097ec0
commit 205666e4ff
24 changed files with 104 additions and 102 deletions
--- a/client/repo.go
+++ b/client/repo.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"net/http"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/trustpinning"
 )
@@ -16,7 +16,7 @@ import (
 // (This is normally defaults to "~/.notary" or "~/.docker/trust" when enabling
 // docker content trust).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	retriever passphrase.Retriever, trustPinning trustpinning.TrustPinConfig) (
+	retriever notary.PassRetriever, trustPinning trustpinning.TrustPinConfig) (
 	*NotaryRepository, error) {

 	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"net/http"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/trustmanager/yubikey"
 	"github.com/docker/notary/trustpinning"
@@ -16,7 +16,7 @@ import (
 // It takes the base directory under where all the trust files will be stored
 // (usually ~/.docker/trust/).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	retriever passphrase.Retriever, trustPinning trustpinning.TrustPinConfig) (
+	retriever notary.PassRetriever, trustPinning trustpinning.TrustPinConfig) (
 	*NotaryRepository, error) {

 	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
--- a/cmd/notary/delegations.go
+++ b/cmd/notary/delegations.go
@@ -5,8 +5,8 @@ import (
 	"io/ioutil"
 	"os"

+	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/tuf/utils"
@@ -41,7 +41,7 @@ var cmdDelegationAddTemplate = usageTemplate{
 type delegationCommander struct {
 	// these need to be set
 	configGetter func() (*viper.Viper, error)
-	retriever    passphrase.Retriever
+	retriever    notary.PassRetriever

 	paths                         []string
 	allPaths, removeAll, forceYes bool
--- a/cmd/notary/integration_nonpkcs11_test.go
+++ b/cmd/notary/integration_nonpkcs11_test.go
@@ -5,6 +5,7 @@ package main
 import (
 	"testing"

+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/spf13/cobra"
 )
@@ -12,7 +13,7 @@ import (
 func init() {
 	NewNotaryCommand = func() *cobra.Command {
 		commander := &notaryCommander{
-			getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever(testPassphrase) },
+			getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever(testPassphrase) },
 		}
 		return commander.GetCommand()
 	}
--- a/cmd/notary/integration_pkcs11_test.go
+++ b/cmd/notary/integration_pkcs11_test.go
@@ -5,6 +5,7 @@ package main
 import (
 	"testing"

+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager/yubikey"
 	"github.com/docker/notary/tuf/data"
@@ -12,7 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 )

-var _retriever passphrase.Retriever
+var _retriever notary.PassRetriever

 func init() {
 	yubikey.SetYubikeyKeyMode(yubikey.KeymodeNone)
@@ -35,7 +36,7 @@ func init() {

 	NewNotaryCommand = func() *cobra.Command {
 		commander := &notaryCommander{
-			getRetriever: func() passphrase.Retriever { return _retriever },
+			getRetriever: func() notary.PassRetriever { return _retriever },
 		}
 		return commander.GetCommand()
 	}
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -1138,7 +1138,7 @@ func exportRoot(t *testing.T, exportTo string) string {
 	// export does not require a password
 	oldNewCommand := NewNotaryCommand
 	NewNotaryCommand = func() *cobra.Command {
-		commander := &notaryCommander{getRetriever: func() passphrase.Retriever { return nil }}
+		commander := &notaryCommander{getRetriever: func() notary.PassRetriever { return nil }}
 		return commander.GetCommand()
 	}
 	defer func() { // but import will, later
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -12,7 +12,6 @@ import (

 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"

 	"github.com/docker/notary"
@@ -84,7 +83,7 @@ var cmdKeyPasswdTemplate = usageTemplate{
 type keyCommander struct {
 	// these need to be set
 	configGetter func() (*viper.Viper, error)
-	getRetriever func() passphrase.Retriever
+	getRetriever func() notary.PassRetriever

 	// these are for command line parsing - no need to set
 	keysExportChangePassphrase bool
--- a/cmd/notary/keys_nonpkcs11.go
+++ b/cmd/notary/keys_nonpkcs11.go
@@ -5,10 +5,10 @@ package main
 import (
 	"errors"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 )

-func getYubiStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
+func getYubiStore(fileKeyStore trustmanager.KeyStore, ret notary.PassRetriever) (trustmanager.KeyStore, error) {
 	return nil, errors.New("Not built with hardware support")
 }
--- a/cmd/notary/keys_pkcs11.go
+++ b/cmd/notary/keys_pkcs11.go
@@ -3,11 +3,11 @@
 package main

 import (
-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/trustmanager/yubikey"
 )

-func getYubiStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
+func getYubiStore(fileKeyStore trustmanager.KeyStore, ret notary.PassRetriever) (trustmanager.KeyStore, error) {
 	return yubikey.NewYubiStore(fileKeyStore, ret)
 }
--- a/cmd/notary/keys_test.go
+++ b/cmd/notary/keys_test.go
@@ -251,7 +251,7 @@ func TestRotateKeyInvalidRoles(t *testing.T) {
 		for _, serverManaged := range []bool{true, false} {
 			k := &keyCommander{
 				configGetter:           func() (*viper.Viper, error) { return viper.New(), nil },
-				getRetriever:           func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+				getRetriever:           func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 				rotateKeyRole:          role,
 				rotateKeyServerManaged: serverManaged,
 			}
@@ -272,7 +272,7 @@ func TestRotateKeyTargetCannotBeServerManaged(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:           func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:           func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:           func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		rotateKeyRole:          data.CanonicalTargetsRole,
 		rotateKeyServerManaged: true,
 	}
@@ -286,7 +286,7 @@ func TestRotateKeyTimestampCannotBeLocallyManaged(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:           func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:           func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:           func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		rotateKeyRole:          data.CanonicalTimestampRole,
 		rotateKeyServerManaged: false,
 	}
@@ -300,7 +300,7 @@ func TestRotateKeyNoGUN(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:  func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:  func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:  func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		rotateKeyRole: data.CanonicalTargetsRole,
 	}
 	err := k.keysRotate(&cobra.Command{}, []string{})
@@ -309,7 +309,7 @@ func TestRotateKeyNoGUN(t *testing.T) {
 }

 // initialize a repo with keys, so they can be rotated
-func setUpRepo(t *testing.T, tempBaseDir, gun string, ret passphrase.Retriever) (
+func setUpRepo(t *testing.T, tempBaseDir, gun string, ret notary.PassRetriever) (
 	*httptest.Server, map[string]string) {

 	// Set up server
@@ -367,7 +367,7 @@ func TestRotateKeyRemoteServerManagesKey(t *testing.T) {
 				v.SetDefault("remote_server.url", ts.URL)
 				return v, nil
 			},
-			getRetriever:           func() passphrase.Retriever { return ret },
+			getRetriever:           func() notary.PassRetriever { return ret },
 			rotateKeyServerManaged: true,
 		}
 		require.NoError(t, k.keysRotate(&cobra.Command{}, []string{gun, role, "-r"}))
@@ -421,7 +421,7 @@ func TestRotateKeyBothKeys(t *testing.T) {
 			v.SetDefault("remote_server.url", ts.URL)
 			return v, nil
 		},
-		getRetriever: func() passphrase.Retriever { return ret },
+		getRetriever: func() notary.PassRetriever { return ret },
 	}
 	require.NoError(t, k.keysRotate(&cobra.Command{}, []string{gun, data.CanonicalTargetsRole}))
 	require.NoError(t, k.keysRotate(&cobra.Command{}, []string{gun, data.CanonicalSnapshotRole}))
@@ -480,7 +480,7 @@ func TestRotateKeyRootIsInteractive(t *testing.T) {
 			v.SetDefault("remote_server.url", ts.URL)
 			return v, nil
 		},
-		getRetriever: func() passphrase.Retriever { return ret },
+		getRetriever: func() notary.PassRetriever { return ret },
 		input:        bytes.NewBuffer([]byte("\n")),
 	}
 	c := &cobra.Command{}
@@ -503,7 +503,7 @@ func TestChangeKeyPassphraseInvalidID(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	err := k.keyPassphraseChange(&cobra.Command{}, []string{"too_short"})
 	require.Error(t, err)
@@ -514,7 +514,7 @@ func TestChangeKeyPassphraseInvalidNumArgs(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	err := k.keyPassphraseChange(&cobra.Command{}, []string{})
 	require.Error(t, err)
@@ -525,7 +525,7 @@ func TestChangeKeyPassphraseNonexistentID(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	// Valid ID size, but does not exist as a key ID
 	err := k.keyPassphraseChange(&cobra.Command{}, []string{strings.Repeat("x", notary.Sha256HexSize)})
@@ -537,7 +537,7 @@ func TestKeyImportMismatchingRoles(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:   func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:   func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:   func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		keysImportRole: "targets",
 	}
 	tempFileName := generateTempTestKeyFile(t, "snapshot")
@@ -552,7 +552,7 @@ func TestKeyImportNoGUNForTargetsPEM(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	tempFileName := generateTempTestKeyFile(t, "targets")
 	defer os.Remove(tempFileName)
@@ -566,7 +566,7 @@ func TestKeyImportNoGUNForSnapshotPEM(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	tempFileName := generateTempTestKeyFile(t, "snapshot")
 	defer os.Remove(tempFileName)
@@ -580,7 +580,7 @@ func TestKeyImportNoGUNForTargetsFlag(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:   func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:   func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:   func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		keysImportRole: "targets",
 	}
 	tempFileName := generateTempTestKeyFile(t, "")
@@ -595,7 +595,7 @@ func TestKeyImportNoGUNForSnapshotFlag(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter:   func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever:   func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever:   func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		keysImportRole: "snapshot",
 	}
 	tempFileName := generateTempTestKeyFile(t, "")
@@ -610,7 +610,7 @@ func TestKeyImportNoRole(t *testing.T) {
 	setUp(t)
 	k := &keyCommander{
 		configGetter: func() (*viper.Viper, error) { return viper.New(), nil },
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}
 	tempFileName := generateTempTestKeyFile(t, "")
 	defer os.Remove(tempFileName)
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -8,6 +8,7 @@ import (
 	"strings"

 	"github.com/Sirupsen/logrus"
+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/version"
 	homedir "github.com/mitchellh/go-homedir"
@@ -55,7 +56,7 @@ func pathRelativeToCwd(path string) string {

 type notaryCommander struct {
 	// this needs to be set
-	getRetriever func() passphrase.Retriever
+	getRetriever func() notary.PassRetriever

 	// these are for command line parsing - no need to set
 	debug             bool
@@ -217,7 +218,7 @@ func askConfirm(input io.Reader) bool {
 	return false
 }

-func getPassphraseRetriever() passphrase.Retriever {
+func getPassphraseRetriever() notary.PassRetriever {
 	baseRetriever := passphrase.PromptRetriever()
 	env := map[string]string{
 		"root":       os.Getenv("NOTARY_ROOT_PASSPHRASE"),
--- a/cmd/notary/main_test.go
+++ b/cmd/notary/main_test.go
@@ -23,7 +23,7 @@ import (
 // the default location for the config file is in ~/.notary/config.json - even if it doesn't exist.
 func TestNotaryConfigFileDefault(t *testing.T) {
 	commander := &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}

 	config, err := commander.parseConfig()
@@ -40,7 +40,7 @@ func TestRemoteServerDefault(t *testing.T) {
 	configFile := filepath.Join(tempDir, "config.json")

 	commander := &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}

 	// set a blank config file, so it doesn't check ~/.notary/config.json by default
@@ -62,7 +62,7 @@ func TestRemoteServerUsesConfigFile(t *testing.T) {
 	configFile := filepath.Join(tempDir, "config.json")

 	commander := &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}

 	// set a config file, so it doesn't check ~/.notary/config.json by default,
@@ -84,7 +84,7 @@ func TestRemoteServerCommandLineFlagOverridesConfig(t *testing.T) {
 	configFile := filepath.Join(tempDir, "config.json")

 	commander := &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 	}

 	// set a config file, so it doesn't check ~/.notary/config.json by default,
@@ -431,7 +431,7 @@ func TestConfigFileTrustPinning(t *testing.T) {
 	}`)
 	defer os.RemoveAll(tempDir)
 	commander := &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		configFile:   filepath.Join(tempDir, "config.json"),
 	}

@@ -453,7 +453,7 @@ func TestConfigFileTrustPinning(t *testing.T) {
 	}`)
 	defer os.RemoveAll(tempDir)
 	commander = &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		configFile:   filepath.Join(tempDir, "config.json"),
 	}

@@ -474,7 +474,7 @@ func TestConfigFileTrustPinning(t *testing.T) {
 	}`, strings.Repeat("x", notary.Sha256HexSize)))
 	defer os.RemoveAll(tempDir)
 	commander = &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		configFile:   filepath.Join(tempDir, "config.json"),
 	}

@@ -495,7 +495,7 @@ func TestConfigFileTrustPinning(t *testing.T) {
 	}`, strings.Repeat("x", notary.Sha256HexSize)))
 	defer os.RemoveAll(tempDir)
 	commander = &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		configFile:   filepath.Join(tempDir, "config.json"),
 	}

@@ -513,7 +513,7 @@ func TestConfigFileTrustPinning(t *testing.T) {
 	}`, "root-ca.crt"))
 	defer os.RemoveAll(tempDir)
 	commander = &notaryCommander{
-		getRetriever: func() passphrase.Retriever { return passphrase.ConstantRetriever("pass") },
+		getRetriever: func() notary.PassRetriever { return passphrase.ConstantRetriever("pass") },
 		configFile:   filepath.Join(tempDir, "config.json"),
 	}

--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -19,7 +19,6 @@ import (
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustpinning"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/utils"
@@ -84,7 +83,7 @@ var cmdTufVerifyTemplate = usageTemplate{
 type tufCommander struct {
 	// these need to be set
 	configGetter func() (*viper.Viper, error)
-	retriever    passphrase.Retriever
+	retriever    notary.PassRetriever

 	// these are for command line parsing - no need to set
 	roles  []string
--- a/cryptoservice/import_export.go
+++ b/cryptoservice/import_export.go
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 )

@@ -61,7 +61,7 @@ func (cs *CryptoService) ExportKey(dest io.Writer, keyID, role string) error {

 // ExportKeyReencrypt exports the specified private key to an io.Writer in
 // PEM format. The key is reencrypted with a new passphrase.
-func (cs *CryptoService) ExportKeyReencrypt(dest io.Writer, keyID string, newPassphraseRetriever passphrase.Retriever) error {
+func (cs *CryptoService) ExportKeyReencrypt(dest io.Writer, keyID string, newPassphraseRetriever notary.PassRetriever) error {
 	privateKey, _, err := cs.GetPrivateKey(keyID)
 	if err != nil {
 		return err
@@ -102,7 +102,7 @@ func (cs *CryptoService) ExportKeyReencrypt(dest io.Writer, keyID string, newPas

 // ExportAllKeys exports all keys to an io.Writer in zip format.
 // newPassphraseRetriever will be used to obtain passphrases to use to encrypt the existing keys.
-func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever passphrase.Retriever) error {
+func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever notary.PassRetriever) error {
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)

@@ -132,7 +132,7 @@ func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever pa
 // ImportKeysZip imports keys from a zip file provided as an zip.Reader. The
 // keys in the root_keys directory are left encrypted, but the other keys are
 // decrypted with the specified passphrase.
-func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader, retriever passphrase.Retriever) error {
+func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader, retriever notary.PassRetriever) error {
 	// Temporarily store the keys in maps, so we can bail early if there's
 	// an error (for example, wrong passphrase), without leaving the key
 	// store in an inconsistent state
@@ -187,7 +187,7 @@ func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader, retriever passphras
 // ExportKeysByGUN exports all keys associated with a specified GUN to an
 // io.Writer in zip format. passphraseRetriever is used to select new passphrases to use to
 // encrypt the keys.
-func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseRetriever passphrase.Retriever) error {
+func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseRetriever notary.PassRetriever) error {
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)

--- a/cryptoservice/import_export_compatibility_test.go
+++ b/cryptoservice/import_export_compatibility_test.go
@@ -8,6 +8,7 @@ import (
 	"os"
 	"testing"

+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
@@ -51,7 +52,7 @@ func TestImport0Dot1Zip(t *testing.T) {
 	assertHasKeys(t, cs, origKeys)
 }

-func get0Dot1(t *testing.T) (*trustmanager.KeyFileStore, passphrase.Retriever, string) {
+func get0Dot1(t *testing.T) (*trustmanager.KeyFileStore, notary.PassRetriever, string) {
 	gun := "docker.com/notary0.1/samplerepo"
 	ret := passphrase.ConstantRetriever("randompass")

@@ -78,7 +79,7 @@ func assertHasKeys(t *testing.T, cs *CryptoService, expectedKeys map[string]stri
 // Export all the keys of a cryptoservice to a zipfile, and import it into a
 // new cryptoService, and return that new cryptoService
 func importExportedZip(t *testing.T, original *CryptoService,
-	ret passphrase.Retriever, gun string) (*CryptoService, string) {
+	ret notary.PassRetriever, gun string) (*CryptoService, string) {

 	// Temporary directory where test files will be created
 	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
--- a/notary.go
+++ b/notary.go
@@ -0,0 +1,7 @@
+package notary
+
+// Retriever is a callback function that should retrieve a passphrase
+// for a given named key. If it should be treated as new passphrase (e.g. with
+// confirmation), createNew will be true. Attempts is passed in so that implementers
+// decide how many chances to give to a human, for example.
+type PassRetriever func(keyName, alias string, createNew bool, attempts int) (passphrase string, giveup bool, err error)
--- a/passphrase/passphrase.go
+++ b/passphrase/passphrase.go
@@ -8,19 +8,13 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"

-	"path/filepath"
-
 	"github.com/docker/docker/pkg/term"
+	"github.com/docker/notary"
 )

-// Retriever is a callback function that should retrieve a passphrase
-// for a given named key. If it should be treated as new passphrase (e.g. with
-// confirmation), createNew will be true. Attempts is passed in so that implementers
-// decide how many chances to give to a human, for example.
-type Retriever func(keyName, alias string, createNew bool, attempts int) (passphrase string, giveup bool, err error)
-
 const (
 	idBytesToDisplay            = 7
 	tufRootAlias                = "root"
@@ -51,7 +45,7 @@ var (
 // PromptRetriever returns a new Retriever which will provide a prompt on stdin
 // and stdout to retrieve a passphrase. The passphrase will be cached such that
 // subsequent prompts will produce the same passphrase.
-func PromptRetriever() Retriever {
+func PromptRetriever() notary.PassRetriever {
 	return PromptRetrieverWithInOut(os.Stdin, os.Stdout, nil)
 }

@@ -60,7 +54,7 @@ func PromptRetriever() Retriever {
 // such that subsequent prompts will produce the same passphrase.
 // aliasMap can be used to specify display names for TUF key aliases. If aliasMap
 // is nil, a sensible default will be used.
-func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]string) Retriever {
+func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]string) notary.PassRetriever {
 	userEnteredTargetsSnapshotsPass := false
 	targetsSnapshotsPass := ""
 	userEnteredRootsPass := false
@@ -194,7 +188,7 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s

 // ConstantRetriever returns a new Retriever which will return a constant string
 // as a passphrase.
-func ConstantRetriever(constantPassphrase string) Retriever {
+func ConstantRetriever(constantPassphrase string) notary.PassRetriever {
 	return func(k, a string, c bool, n int) (string, bool, error) {
 		return constantPassphrase, false, nil
 	}
--- a/passphrase/passphrase_test.go
+++ b/passphrase/passphrase_test.go
@@ -7,11 +7,12 @@ import (
 	"strings"
 	"testing"

+	"github.com/docker/notary"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/require"
 )

-func assertAskOnceForKey(t *testing.T, in, out *bytes.Buffer, retriever Retriever, password, role string) {
+func assertAskOnceForKey(t *testing.T, in, out *bytes.Buffer, retriever notary.PassRetriever, password, role string) {
 	_, err := in.WriteString(password + "\n")
 	require.NoError(t, err)

--- a/signer/api/rpc_api_test.go
+++ b/signer/api/rpc_api_test.go
@@ -6,8 +6,8 @@ import (
 	"net"
 	"testing"

+	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
@@ -25,7 +25,7 @@ var (
 	sClient    pb.SignerClient
 	grpcServer *grpc.Server
 	void       *pb.Void
-	pr         passphrase.Retriever
+	pr         notary.PassRetriever
 	health     = map[string]string{
 		"db":    "ok",
 		"other": "not ok",
--- a/signer/keydbstore/keydbstore.go
+++ b/signer/keydbstore/keydbstore.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"sync"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	jose "github.com/dvsekhvalnov/jose2go"
@@ -23,7 +23,7 @@ type KeyDBStore struct {
 	sync.Mutex
 	db               gorm.DB
 	defaultPassAlias string
-	retriever        passphrase.Retriever
+	retriever        notary.PassRetriever
 	cachedKeys       map[string]data.PrivateKey
 }

@@ -45,7 +45,7 @@ func (g GormPrivateKey) TableName() string {
 }

 // NewKeyDBStore returns a new KeyDBStore backed by a SQL database
-func NewKeyDBStore(passphraseRetriever passphrase.Retriever, defaultPassAlias string,
+func NewKeyDBStore(passphraseRetriever notary.PassRetriever, defaultPassAlias string,
 	dbDialect string, dbArgs ...interface{}) (*KeyDBStore, error) {
 	cachedKeys := make(map[string]data.PrivateKey)

--- a/signer/keydbstore/rethink_keydbstore.go
+++ b/signer/keydbstore/rethink_keydbstore.go
@@ -6,7 +6,7 @@ import (
 	"sync"
 	"time"

-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/storage/rethinkdb"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
@@ -21,7 +21,7 @@ type RethinkDBKeyStore struct {
 	sess             *gorethink.Session
 	dbName           string
 	defaultPassAlias string
-	retriever        passphrase.Retriever
+	retriever        notary.PassRetriever
 	cachedKeys       map[string]data.PrivateKey
 	user             string
 	password         string
@@ -50,7 +50,7 @@ func (g RDBPrivateKey) TableName() string {
 }

 // NewRethinkDBKeyStore returns a new RethinkDBKeyStore backed by a RethinkDB database
-func NewRethinkDBKeyStore(dbName, username, password string, passphraseRetriever passphrase.Retriever, defaultPassAlias string, rethinkSession *gorethink.Session) *RethinkDBKeyStore {
+func NewRethinkDBKeyStore(dbName, username, password string, passphraseRetriever notary.PassRetriever, defaultPassAlias string, rethinkSession *gorethink.Session) *RethinkDBKeyStore {
 	cachedKeys := make(map[string]data.PrivateKey)

 	return &RethinkDBKeyStore{
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -9,7 +9,6 @@ import (

 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/tuf/data"
 )

@@ -19,7 +18,7 @@ type keyInfoMap map[string]KeyInfo
 type KeyFileStore struct {
 	sync.Mutex
 	SimpleFileStore
-	passphrase.Retriever
+	notary.PassRetriever
 	cachedKeys map[string]*cachedKey
 	keyInfoMap
 }
@@ -28,7 +27,7 @@ type KeyFileStore struct {
 type KeyMemoryStore struct {
 	sync.Mutex
 	MemoryFileStore
-	passphrase.Retriever
+	notary.PassRetriever
 	cachedKeys map[string]*cachedKey
 	keyInfoMap
 }
@@ -42,7 +41,7 @@ type KeyInfo struct {

 // NewKeyFileStore returns a new KeyFileStore creating a private directory to
 // hold the keys.
-func NewKeyFileStore(baseDir string, passphraseRetriever passphrase.Retriever) (*KeyFileStore, error) {
+func NewKeyFileStore(baseDir string, passphraseRetriever notary.PassRetriever) (*KeyFileStore, error) {
 	baseDir = filepath.Join(baseDir, notary.PrivDir)
 	fileStore, err := NewPrivateSimpleFileStore(baseDir, keyExtension)
 	if err != nil {
@@ -52,9 +51,9 @@ func NewKeyFileStore(baseDir string, passphraseRetriever passphrase.Retriever) (
 	keyInfoMap := make(keyInfoMap)

 	keyStore := &KeyFileStore{SimpleFileStore: *fileStore,
-		Retriever:  passphraseRetriever,
-		cachedKeys: cachedKeys,
-		keyInfoMap: keyInfoMap,
+		PassRetriever: passphraseRetriever,
+		cachedKeys:    cachedKeys,
+		keyInfoMap:    keyInfoMap,
 	}

 	// Load this keystore's ID --> gun/role map
@@ -151,7 +150,7 @@ func (s *KeyFileStore) AddKey(keyInfo KeyInfo, privKey data.PrivateKey) error {
 	if keyInfo.Role == data.CanonicalRootRole || data.IsDelegation(keyInfo.Role) || !data.ValidRole(keyInfo.Role) {
 		keyInfo.Gun = ""
 	}
-	err := addKey(s, s.Retriever, s.cachedKeys, filepath.Join(keyInfo.Gun, privKey.ID()), keyInfo.Role, privKey)
+	err := addKey(s, s.PassRetriever, s.cachedKeys, filepath.Join(keyInfo.Gun, privKey.ID()), keyInfo.Role, privKey)
 	if err != nil {
 		return err
 	}
@@ -167,7 +166,7 @@ func (s *KeyFileStore) GetKey(name string) (data.PrivateKey, string, error) {
 	if keyInfo, ok := s.keyInfoMap[name]; ok {
 		name = filepath.Join(keyInfo.Gun, name)
 	}
-	return getKey(s, s.Retriever, s.cachedKeys, name)
+	return getKey(s, s.PassRetriever, s.cachedKeys, name)
 }

 // ListKeys returns a list of unique PublicKeys present on the KeyFileStore, by returning a copy of the keyInfoMap
@@ -205,16 +204,16 @@ func (s *KeyFileStore) ExportKey(keyID string) ([]byte, error) {
 }

 // NewKeyMemoryStore returns a new KeyMemoryStore which holds keys in memory
-func NewKeyMemoryStore(passphraseRetriever passphrase.Retriever) *KeyMemoryStore {
+func NewKeyMemoryStore(passphraseRetriever notary.PassRetriever) *KeyMemoryStore {
 	memStore := NewMemoryFileStore()
 	cachedKeys := make(map[string]*cachedKey)

 	keyInfoMap := make(keyInfoMap)

 	keyStore := &KeyMemoryStore{MemoryFileStore: *memStore,
-		Retriever:  passphraseRetriever,
-		cachedKeys: cachedKeys,
-		keyInfoMap: keyInfoMap,
+		PassRetriever: passphraseRetriever,
+		cachedKeys:    cachedKeys,
+		keyInfoMap:    keyInfoMap,
 	}

 	// Load this keystore's ID --> gun/role map
@@ -235,7 +234,7 @@ func (s *KeyMemoryStore) AddKey(keyInfo KeyInfo, privKey data.PrivateKey) error
 	if keyInfo.Role == data.CanonicalRootRole || data.IsDelegation(keyInfo.Role) || !data.ValidRole(keyInfo.Role) {
 		keyInfo.Gun = ""
 	}
-	err := addKey(s, s.Retriever, s.cachedKeys, filepath.Join(keyInfo.Gun, privKey.ID()), keyInfo.Role, privKey)
+	err := addKey(s, s.PassRetriever, s.cachedKeys, filepath.Join(keyInfo.Gun, privKey.ID()), keyInfo.Role, privKey)
 	if err != nil {
 		return err
 	}
@@ -251,7 +250,7 @@ func (s *KeyMemoryStore) GetKey(name string) (data.PrivateKey, string, error) {
 	if keyInfo, ok := s.keyInfoMap[name]; ok {
 		name = filepath.Join(keyInfo.Gun, name)
 	}
-	return getKey(s, s.Retriever, s.cachedKeys, name)
+	return getKey(s, s.PassRetriever, s.cachedKeys, name)
 }

 // ListKeys returns a list of unique PublicKeys present on the KeyFileStore, by returning a copy of the keyInfoMap
@@ -309,7 +308,7 @@ func KeyInfoFromPEM(pemBytes []byte, filename string) (string, KeyInfo, error) {
 	return keyID, KeyInfo{Gun: gun, Role: role}, nil
 }

-func addKey(s Storage, passphraseRetriever passphrase.Retriever, cachedKeys map[string]*cachedKey, name, role string, privKey data.PrivateKey) error {
+func addKey(s Storage, passphraseRetriever notary.PassRetriever, cachedKeys map[string]*cachedKey, name, role string, privKey data.PrivateKey) error {

 	var (
 		chosenPassphrase string
@@ -365,7 +364,7 @@ func getKeyRole(s Storage, keyID string) (string, bool, error) {
 }

 // GetKey returns the PrivateKey given a KeyID
-func getKey(s Storage, passphraseRetriever passphrase.Retriever, cachedKeys map[string]*cachedKey, name string) (data.PrivateKey, string, error) {
+func getKey(s Storage, passphraseRetriever notary.PassRetriever, cachedKeys map[string]*cachedKey, name string) (data.PrivateKey, string, error) {
 	cachedKeyEntry, ok := cachedKeys[name]
 	if ok {
 		return cachedKeyEntry.key, cachedKeyEntry.alias, nil
@@ -439,7 +438,7 @@ func getRawKey(s Storage, name string) ([]byte, string, error) {

 // GetPasswdDecryptBytes gets the password to decrypt the given pem bytes.
 // Returns the password and private key
-func GetPasswdDecryptBytes(passphraseRetriever passphrase.Retriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
+func GetPasswdDecryptBytes(passphraseRetriever notary.PassRetriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
 	var (
 		passwd  string
 		retErr  error
--- a/trustmanager/keyfilestore_test.go
+++ b/trustmanager/keyfilestore_test.go
@@ -10,7 +10,6 @@ import (
 	"testing"

 	"github.com/docker/notary"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/require"
 )
@@ -613,7 +612,7 @@ func TestKeysAreCached(t *testing.T) {
 	require.NoError(t, err, "failed to create a temporary directory")
 	defer os.RemoveAll(tempBaseDir)

-	var countingPassphraseRetriever passphrase.Retriever
+	var countingPassphraseRetriever notary.PassRetriever

 	numTimesCalled := 0
 	countingPassphraseRetriever = func(keyId, alias string, createNew bool, attempts int) (passphrase string, giveup bool, err error) {
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -17,7 +17,7 @@ import (
 	"time"

 	"github.com/Sirupsen/logrus"
-	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/tuf/signed"
@@ -132,7 +132,7 @@ type yubiSlot struct {
 // YubiPrivateKey represents a private key inside of a yubikey
 type YubiPrivateKey struct {
 	data.ECDSAPublicKey
-	passRetriever passphrase.Retriever
+	passRetriever notary.PassRetriever
 	slot          []byte
 	libLoader     pkcs11LibLoader
 }
@@ -145,7 +145,7 @@ type yubikeySigner struct {
 // NewYubiPrivateKey returns a YubiPrivateKey, which implements the data.PrivateKey
 // interface except that the private material is inacessible
 func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey,
-	passRetriever passphrase.Retriever) *YubiPrivateKey {
+	passRetriever notary.PassRetriever) *YubiPrivateKey {

 	return &YubiPrivateKey{
 		ECDSAPublicKey: pubKey,
@@ -228,7 +228,7 @@ func addECDSAKey(
 	session pkcs11.SessionHandle,
 	privKey data.PrivateKey,
 	pkcs11KeyID []byte,
-	passRetriever passphrase.Retriever,
+	passRetriever notary.PassRetriever,
 	role string,
 ) error {
 	logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID())
@@ -345,7 +345,7 @@ func getECDSAKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byt
 }

 // sign returns a signature for a given signature request
-func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) {
+func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever notary.PassRetriever, payload []byte) ([]byte, error) {
 	err := login(ctx, session, passRetriever, pkcs11.CKU_USER, UserPin)
 	if err != nil {
 		return nil, fmt.Errorf("error logging in: %v", err)
@@ -404,7 +404,7 @@ func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pass
 	return sig[:], nil
 }

-func yubiRemoveKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
+func yubiRemoveKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever notary.PassRetriever, keyID string) error {
 	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SOUserPin)
 	if err != nil {
 		return err
@@ -615,7 +615,7 @@ func getNextEmptySlot(ctx IPKCS11Ctx, session pkcs11.SessionHandle) ([]byte, err

 // YubiStore is a KeyStore for private keys inside a Yubikey
 type YubiStore struct {
-	passRetriever passphrase.Retriever
+	passRetriever notary.PassRetriever
 	keys          map[string]yubiSlot
 	backupStore   trustmanager.KeyStore
 	libLoader     pkcs11LibLoader
@@ -623,7 +623,7 @@ type YubiStore struct {

 // NewYubiStore returns a YubiStore, given a backup key store to write any
 // generated keys to (usually a KeyFileStore)
-func NewYubiStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) (
+func NewYubiStore(backupStore trustmanager.KeyStore, passphraseRetriever notary.PassRetriever) (
 	*YubiStore, error) {

 	s := &YubiStore{
@@ -874,7 +874,7 @@ func IsAccessible() bool {
 	return true
 }

-func login(ctx IPKCS11Ctx, session pkcs11.SessionHandle, passRetriever passphrase.Retriever, userFlag uint, defaultPassw string) error {
+func login(ctx IPKCS11Ctx, session pkcs11.SessionHandle, passRetriever notary.PassRetriever, userFlag uint, defaultPassw string) error {
 	// try default password
 	err := ctx.Login(session, userFlag, defaultPassw)
 	if err == nil {