From ae11483a7b856d94c057dab00754320d00295aa9 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Mon, 19 Oct 2015 16:02:50 -0700
Subject: [PATCH 01/85] initial work on pkcs11 support

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 signer/api/ecdsa_hardware_crypto_service.go | 127 ++++++++++++++++++++
 signer/api/rsa_hardware_crypto_service.go   |   8 +-
 signer/keys/keys.go                         |  43 +++----
 3 files changed, 153 insertions(+), 25 deletions(-)
 create mode 100644 signer/api/ecdsa_hardware_crypto_service.go

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
new file mode 100644
index 0000000000..d52295c8e8
--- /dev/null
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -0,0 +1,127 @@
+package api
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"log"
+
+	"github.com/docker/notary/trustmanager"
+	"github.com/endophage/gotuf/data"
+	"github.com/miekg/pkcs11"
+)
+
+// YubikeyECDSACryptoService is an implementation of SigningService
+type YubikeyECDSACryptoService struct {
+	context *pkcs11.Ctx
+	session pkcs11.SessionHandle
+}
+
+// Create creates a key and returns its public components
+func (s *YubikeyECDSACryptoService) Create(role string, algo data.KeyAlgorithm) (data.PublicKey, error) {
+	if role != "root" {
+		return nil, errors.New("can only generate root keys inside of Yubikey")
+	}
+	// TODO(diogo): Generate ECDSA key
+	// TODO(diogo): Generate Certificate from ECDSA public key
+	// TODO(diogo): Import Private key and certificate into yubikey
+	// TODO(diogo): Return TUF Key
+	return trustmanager.GenerateECDSAKey(rand.Reader)
+}
+
+// RemoveKey removes a key from the key database
+func (s *YubikeyECDSACryptoService) RemoveKey(keyID string) error {
+	return errors.New("cannot delete root key from Yubikey")
+}
+
+// GetKey returns the public components of a particular key
+func (s *YubikeyECDSACryptoService) GetKey(keyID string) data.PublicKey {
+	// TODO(diogo): Get the certificate out of the Yubikey and return the ID from it
+	class = pkcs11.CKO_PRIVATE_KEY
+	privateKeyTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
+		pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{2}),
+	}
+
+	if err := s.context.FindObjectsInit(session, privateKeyTemplate); err != nil {
+		return nil
+	}
+	obj, b, err := s.context.FindObjects(session, 1)
+	if err != nil {
+		return nil
+	}
+	if err = s.context.FindObjectsFinal(session); e != nil {
+		return nil
+	}
+	if len(obj) != 1 {
+		return nil
+	}
+
+	return data.NewPublicKey(data.ECDSAKey, []byte{0})
+}
+
+// Sign returns a signature for a given signature request
+func (s *YubikeyECDSACryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
+	signatures := make([]data.Signature, 0, len(keyIDs))
+	for _, keyid := range keyIDs {
+		key := s.GetKey(keyID)
+		if key == nil {
+			// We skip keys that aren't found
+			continue
+		}
+
+		// Define the ECDSA Private key template
+		class = pkcs11.CKO_PRIVATE_KEY
+		privateKeyTemplate := []*pkcs11.Attribute{
+			pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
+			pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
+			pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{2}),
+		}
+
+		if err := s.context.FindObjectsInit(session, privateKeyTemplate); err != nil {
+			return nil, err
+		}
+		obj, b, err := s.context.FindObjects(session, 1)
+		if err != nil {
+			return nil, err
+		}
+		if err = s.context.FindObjectsFinal(session); e != nil {
+			return nil, err
+		}
+		if len(obj) != 1 {
+			return nil, errors.New("length of objects found not 1")
+		}
+
+		var sig []byte
+		s.context.SignInit(s.session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_ECDSA, nil)}, obj[0])
+
+		// Get the SHA256 of the payload
+		digest := sha256.Sum256(payload)
+
+		sig, err := s.context.Sign(s.session, digest)
+		if err != nil {
+			log.Printf("Error while signing: %s", err)
+			return nil, err
+		}
+
+		if sig == nil {
+			return nil, errors.New("Failed to create signature")
+		}
+
+		signatures = append(signatures, data.Signature{
+			KeyID:     keyid,
+			Method:    data.ECDSASignature,
+			Signature: sig[:],
+		})
+	}
+	return signatures, nil
+}
+
+// NewYubikeyECDSACryptoService returns an instance of RSAHardwareCryptoService
+func NewYubikeyECDSACryptoService(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) *YubikeyECDSACryptoService {
+	return &YubikeyECDSACryptoService{
+		context: ctx,
+		session: session,
+	}
+}
diff --git a/signer/api/rsa_hardware_crypto_service.go b/signer/api/rsa_hardware_crypto_service.go
index 8e673be341..5ffe8536d5 100644
--- a/signer/api/rsa_hardware_crypto_service.go
+++ b/signer/api/rsa_hardware_crypto_service.go
@@ -17,7 +17,7 @@ import (
 
 // RSAHardwareCryptoService is an implementation of SigningService
 type RSAHardwareCryptoService struct {
-	keys    map[string]*keys.HSMRSAKey
+	keys    map[string]*keys.HSMKey
 	context *pkcs11.Ctx
 	session pkcs11.SessionHandle
 }
@@ -68,7 +68,7 @@ func (s *RSAHardwareCryptoService) Create(role, algo string) (data.PublicKey, er
 		pkcs11.NewAttribute(pkcs11.CKA_MODULUS, nil),
 	}
 
-	// Retrieve the public-key material to be able to create a new HSMRSAKey
+	// Retrieve the public-key material to be able to create a new HSMKey
 	attr, err := s.context.GetAttributeValue(s.session, pub, template)
 	if err != nil {
 		return nil, errors.New("Failed to get Attribute value.")
@@ -97,7 +97,7 @@ func (s *RSAHardwareCryptoService) Create(role, algo string) (data.PublicKey, er
 	}
 
 	// (diogo): Ideally I would like to return base64 PEM encoded public keys to the client
-	k := keys.NewHSMRSAKey(pubBytes, priv)
+	k := keys.NewHSMKey(pubBytes, priv)
 
 	keyID := k.ID()
 
@@ -190,7 +190,7 @@ func (s *RSAHardwareCryptoService) Sign(keyIDs []string, payload []byte) ([]data
 // NewRSAHardwareCryptoService returns an instance of RSAHardwareCryptoService
 func NewRSAHardwareCryptoService(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) *RSAHardwareCryptoService {
 	return &RSAHardwareCryptoService{
-		keys:    make(map[string]*keys.HSMRSAKey),
+		keys:    make(map[string]*keys.HSMKey),
 		context: ctx,
 		session: session,
 	}
diff --git a/signer/keys/keys.go b/signer/keys/keys.go
index 80396c6939..19cb83022e 100644
--- a/signer/keys/keys.go
+++ b/signer/keys/keys.go
@@ -16,48 +16,49 @@ var (
 	ErrFailedKeyGeneration = errors.New("notary-signer: failed to generate new key")
 )
 
-// HSMRSAKey represents the information for an HSMRSAKey with ObjectHandle for private portion
-type HSMRSAKey struct {
-	id      string
-	public  []byte
-	private pkcs11.ObjectHandle
+// HSMKey represents the information for an HSMKey with ObjectHandle for private portion
+type HSMKey struct {
+	id        string
+	algorithm data.KeyAlgorithm
+	public    []byte
+	private   pkcs11.ObjectHandle
 }
 
-// NewHSMRSAKey returns a HSMRSAKey
-func NewHSMRSAKey(public []byte, private pkcs11.ObjectHandle) *HSMRSAKey {
-	return &HSMRSAKey{
+// NewHSMKey returns a HSMKey
+func NewHSMKey(public []byte, private pkcs11.ObjectHandle) *HSMKey {
+	return &HSMKey{
 		public:  public,
 		private: private,
 	}
 }
 
 // Algorithm implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Algorithm() string {
-	return data.RSAKey
+func (k *HSMKey) Algorithm() data.KeyAlgorithm {
+	return k.algorithm
 }
 
 // ID implements a method of the data.Key interface
-func (rsa *HSMRSAKey) ID() string {
-	if rsa.id == "" {
-		pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
-		rsa.id = pubK.ID()
+func (k *HSMKey) ID() string {
+	if k.id == "" {
+		pubK := data.NewPublicKey(k.algorithm, k.public)
+		k.id = pubK.ID()
 	}
-	return rsa.id
+	return k.id
 }
 
 // Public implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Public() []byte {
-	return rsa.public
+func (k *HSMKey) Public() []byte {
+	return k.public
 }
 
 // Private implements a method of the data.PrivateKey interface
-func (rsa *HSMRSAKey) Private() []byte {
+func (k *HSMKey) Private() []byte {
 	// Not possible to return private key bytes from a hardware device
 	return nil
 }
 
-// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMRSAKey
+// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMKey
 // structure
-func (rsa *HSMRSAKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
-	return rsa.private
+func (k *HSMKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
+	return k.private
 }

From 21138e6badd7639528a0ca20e95e9e11bfe480c1 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Wed, 21 Oct 2015 12:21:03 -0700
Subject: [PATCH 02/85] Working version of Notary and Yubikey

Signed-off-by: Diogo Monica <diogo@docker.com>

Remove symlinks from notary-client repo creation

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: Diogo Monica <diogo@docker.com>

WIP

Signed-off-by: Diogo Monica <diogo@docker.com>

working yubikey integration
Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

Fixing small colon bug

Signed-off-by: Diogo Monica <diogo@docker.com>

Added things. Ship it.

Signed-off-by: Diogo Monica <diogo@docker.com>

Bringing ecdsahwcryptosigner to 2015

Signed-off-by: Diogo Monica <diogo@docker.com>

Working version of notary and yubikey

Signed-off-by: Diogo Monica <diogo@docker.com>
---
 client/client.go                            |   4 +-
 cmd/notary-signer/main.go                   |   3 +-
 cmd/notary/tuf.go                           |  21 +-
 cryptoservice/certificate.go                |  11 +-
 cryptoservice/crypto_service.go             |  14 +-
 signer/api/ecdsa_hardware_crypto_service.go | 431 +++++++++++++++-----
 signer/api/rsa_hardware_crypto_service.go   |   8 +-
 signer/{ => keydbstore}/keydbstore.go       |   2 +-
 signer/{ => keydbstore}/keydbstore_test.go  |   2 +-
 signer/keys/keys.go                         |  43 +-
 tuf/data/keys.go                            |  17 +
 11 files changed, 398 insertions(+), 158 deletions(-)
 rename signer/{ => keydbstore}/keydbstore.go (99%)
 rename signer/{ => keydbstore}/keydbstore_test.go (99%)

diff --git a/client/client.go b/client/client.go
index 03b689ca15..36a361d2a6 100644
--- a/client/client.go
+++ b/client/client.go
@@ -15,6 +15,7 @@ import (
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf"
 	tufclient "github.com/docker/notary/tuf/client"
@@ -108,7 +109,8 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 		return nil, err
 	}
 
-	cryptoService := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
+	yubiKeyStore := api.NewYubiKeyStore()
+	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
 
 	nRepo := &NotaryRepository{
 		gun:             gun,
diff --git a/cmd/notary-signer/main.go b/cmd/notary-signer/main.go
index 37339329ff..a904ba76ae 100644
--- a/cmd/notary-signer/main.go
+++ b/cmd/notary-signer/main.go
@@ -22,6 +22,7 @@ import (
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/signer"
 	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/signer/keydbstore"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/utils"
 	"github.com/docker/notary/version"
@@ -155,7 +156,7 @@ func main() {
 
 	defaultAlias := mainViper.GetString(defaultAliasEnv)
 	logrus.Debug("Default Alias: ", defaultAlias)
-	keyStore, err := signer.NewKeyDBStore(passphraseRetriever, defaultAlias, configDBType, dbSQL)
+	keyStore, err := keydbstore.NewKeyDBStore(passphraseRetriever, defaultAlias, configDBType, dbSQL)
 	if err != nil {
 		log.Fatalf("failed to create a new keydbstore: %v", err)
 	}
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index 2120675c46..6faf590002 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -20,6 +20,7 @@ import (
 	"github.com/docker/distribution/registry/client/transport"
 	"github.com/docker/docker/pkg/term"
 	notaryclient "github.com/docker/notary/client"
+	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/utils"
 	"github.com/spf13/cobra"
 )
@@ -123,26 +124,20 @@ func tufInit(cmd *cobra.Command, args []string) {
 		fatalf(err.Error())
 	}
 
-	keysMap := make(map[string]string)
-	for k, role := range nRepo.KeyStoreManager.KeyStore.ListKeys() {
-		if role == "root" {
-			keysMap[k] = role
-		}
-	}
+	rootKeyList := nRepo.CryptoService.ListKeys(data.CanonicalRootRole)
 
 	var rootKeyID string
-	if len(keysMap) < 1 {
+	if len(rootKeyList) < 1 {
 		fmt.Println("No root keys found. Generating a new root key...")
-		rootKeyID, err = nRepo.KeyStoreManager.GenRootKey("ECDSA")
+		rootPublicKey, err := nRepo.CryptoService.Create(data.CanonicalRootRole, data.ECDSAKey)
+		rootKeyID = rootPublicKey.ID()
 		if err != nil {
 			fatalf(err.Error())
 		}
 	} else {
-		// TODO(diogo): ask which root key to use
-		for keyID := range keysMap {
-			rootKeyID = keyID
-		}
-
+		// Choses the first root key available, which is initialization specific
+		// but should return the HW one first.
+		rootKeyID = rootKeyList[0]
 		fmt.Printf("Root key found, using: %s\n", rootKeyID)
 	}
 
diff --git a/cryptoservice/certificate.go b/cryptoservice/certificate.go
index 6e932ed288..a23bac83ec 100644
--- a/cryptoservice/certificate.go
+++ b/cryptoservice/certificate.go
@@ -11,12 +11,9 @@ import (
 
 // GenerateCertificate generates an X509 Certificate from a template, given a GUN
 func GenerateCertificate(rootKey data.PrivateKey, gun string) (*x509.Certificate, error) {
-
-	switch rootKey.(type) {
-	case *data.RSAPrivateKey, *data.ECDSAPrivateKey:
-		// go doesn't fall through
-	default:
-		return nil, fmt.Errorf("only bare RSA or ECDSA keys (not x509 variants) are currently supported. Found: %s", rootKey.Algorithm())
+	signer := rootKey.CryptoSigner()
+	if signer == nil {
+		return nil, fmt.Errorf("key type not supported for Certificate generation: %s\n", rootKey.Algorithm())
 	}
 
 	template, err := trustmanager.NewCertificate(gun)
@@ -24,7 +21,7 @@ func GenerateCertificate(rootKey data.PrivateKey, gun string) (*x509.Certificate
 		return nil, fmt.Errorf("failed to create the certificate template for: %s (%v)", gun, err)
 	}
 
-	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, rootKey.CryptoSigner().Public(), rootKey.CryptoSigner())
+	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, signer.Public(), signer)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create the certificate for: %s (%v)", gun, err)
 	}
diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 4b0ec94aae..ec0971c34e 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -115,6 +115,7 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
 		// key).  If that fails, then we don't have the key.
 		privKey, _, err := ccs.GetPrivateKey(keyName)
 		if err != nil {
+			logrus.Debugf("error attempting to retrieve private key: %s, %v", keyid, err)
 			keyName = filepath.Join(ccs.gun, keyid)
 			privKey, _, err = ccs.GetPrivateKey(keyName)
 			if err != nil {
@@ -123,16 +124,7 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
 			}
 		}
 
-		var sigAlgorithm data.SigAlgorithm
-
-		switch privKey.(type) {
-		case *data.RSAPrivateKey:
-			sigAlgorithm = data.RSAPSSSignature
-		case *data.ECDSAPrivateKey:
-			sigAlgorithm = data.ECDSASignature
-		case *data.ED25519PrivateKey:
-			sigAlgorithm = data.EDDSASignature
-		}
+		sigAlgo := privKey.SignatureAlgorithm()
 		sig, err := privKey.Sign(rand.Reader, payload, nil)
 		if err != nil {
 			logrus.Debugf("ignoring error attempting to %s sign with keyID: %s, %v", privKey.Algorithm(), keyid, err)
@@ -144,7 +136,7 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
 		// Append signatures to result array
 		signatures = append(signatures, data.Signature{
 			KeyID:     keyid,
-			Method:    sigAlgorithm,
+			Method:    sigAlgo,
 			Signature: sig[:],
 		})
 	}
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index d52295c8e8..b025900d0f 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -1,127 +1,364 @@
+// +build pkcs11
 package api
 
 import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/x509"
 	"errors"
-	"log"
+	"fmt"
+	"io"
+	"math/big"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/trustmanager"
-	"github.com/endophage/gotuf/data"
+	"github.com/docker/notary/tuf/data"
 	"github.com/miekg/pkcs11"
 )
 
-// YubikeyECDSACryptoService is an implementation of SigningService
-type YubikeyECDSACryptoService struct {
-	context *pkcs11.Ctx
-	session pkcs11.SessionHandle
+const pkcs11Lib = "/usr/local/lib/libykcs11.so"
+const USER_PIN = "123456"
+
+// Hardcoded yubikey PKCS11 ID
+var YUBIKEY_ROOT_KEY_ID = []byte{2}
+
+// YubiPrivateKey represents a private key inside of a yubikey
+type YubiPrivateKey struct {
+	data.ECDSAPublicKey
 }
 
-// Create creates a key and returns its public components
-func (s *YubikeyECDSACryptoService) Create(role string, algo data.KeyAlgorithm) (data.PublicKey, error) {
-	if role != "root" {
-		return nil, errors.New("can only generate root keys inside of Yubikey")
-	}
-	// TODO(diogo): Generate ECDSA key
-	// TODO(diogo): Generate Certificate from ECDSA public key
-	// TODO(diogo): Import Private key and certificate into yubikey
-	// TODO(diogo): Return TUF Key
-	return trustmanager.GenerateECDSAKey(rand.Reader)
+type YubikeySigner struct {
+	YubiPrivateKey
 }
 
-// RemoveKey removes a key from the key database
-func (s *YubikeyECDSACryptoService) RemoveKey(keyID string) error {
-	return errors.New("cannot delete root key from Yubikey")
+func NewYubiPrivateKey(pubKey data.ECDSAPublicKey) *YubiPrivateKey {
+	return &YubiPrivateKey{ECDSAPublicKey: pubKey}
 }
 
-// GetKey returns the public components of a particular key
-func (s *YubikeyECDSACryptoService) GetKey(keyID string) data.PublicKey {
-	// TODO(diogo): Get the certificate out of the Yubikey and return the ID from it
-	class = pkcs11.CKO_PRIVATE_KEY
-	privateKeyTemplate := []*pkcs11.Attribute{
-		pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
-		pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
-		pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{2}),
-	}
-
-	if err := s.context.FindObjectsInit(session, privateKeyTemplate); err != nil {
-		return nil
-	}
-	obj, b, err := s.context.FindObjects(session, 1)
+func (ys *YubikeySigner) Public() crypto.PublicKey {
+	publicKey, err := x509.ParsePKIXPublicKey(ys.YubiPrivateKey.Public())
 	if err != nil {
 		return nil
 	}
-	if err = s.context.FindObjectsFinal(session); e != nil {
-		return nil
+
+	return publicKey
+}
+
+// CryptoSigner returns a crypto.Signer tha wraps the YubiPrivateKey. Needed for
+// Certificate generation only
+func (y *YubiPrivateKey) CryptoSigner() crypto.Signer {
+	return &YubikeySigner{YubiPrivateKey: *y}
+}
+
+// Private is not implemented in hardware  keys
+func (y *YubiPrivateKey) Private() []byte {
+	// We cannot return the private material from a Yubikey
+	// TODO(david): We probably want to return an error here
+	return nil
+}
+
+func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm {
+	return data.ECDSASignature
+}
+
+func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return nil, err
 	}
-	if len(obj) != 1 {
-		return nil
+	defer cleanup(ctx, session)
+
+	sig, err := sign(ctx, session, YUBIKEY_ROOT_KEY_ID, msg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to sign using Yubikey: %v", err)
 	}
 
-	return data.NewPublicKey(data.ECDSAKey, []byte{0})
+	return sig, nil
+}
+
+// addECDSAKey adds a key to the yubikey
+func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte) error {
+	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
+
+	// TODO(diogo): Figure out CKU_SO with yubikey
+	err := ctx.Login(session, pkcs11.CKU_SO, "010203040506070801020304050607080102030405060708")
+	if err != nil {
+		return err
+	}
+	defer ctx.Logout(session)
+
+	fmt.Println("Parsing EC private key")
+	// Create an ecdsa.PrivateKey out of the private key bytes
+	ecdsaPrivKey, err := x509.ParseECPrivateKey(privKey.Private())
+	if err != nil {
+		return err
+	}
+
+	ecdsaPrivKeyD := ecdsaPrivKey.D.Bytes()
+	logrus.Debugf("Getting D bytes: %v\n", ecdsaPrivKeyD)
+
+	template, err := trustmanager.NewCertificate(data.CanonicalRootRole)
+	if err != nil {
+		return fmt.Errorf("failed to create the certificate template: %v", err)
+	}
+
+	certBytes, err := x509.CreateCertificate(rand.Reader, template, template, ecdsaPrivKey.Public(), ecdsaPrivKey)
+	if err != nil {
+		return fmt.Errorf("failed to create the certificate: %v", err)
+	}
+	fmt.Println("Got a certificate!")
+
+	certTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE),
+		pkcs11.NewAttribute(pkcs11.CKA_VALUE, certBytes),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+	}
+
+	privateKeyTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
+		pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+		pkcs11.NewAttribute(pkcs11.CKA_EC_PARAMS, []byte{0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07}),
+		pkcs11.NewAttribute(pkcs11.CKA_VALUE, ecdsaPrivKeyD),
+	}
+
+	fmt.Println("About to import the certificate")
+
+	_, err = ctx.CreateObject(session, certTemplate)
+	if err != nil {
+		return fmt.Errorf("error importing: %v", err)
+	}
+
+	fmt.Println("About to import the private key")
+	_, err = ctx.CreateObject(session, privateKeyTemplate)
+	if err != nil {
+		return fmt.Errorf("error importing: %v", err)
+	}
+
+	return nil
+}
+
+func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte) (*data.ECDSAPublicKey, string, error) {
+	findTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PUBLIC_KEY),
+	}
+
+	attrTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, []byte{0}),
+		pkcs11.NewAttribute(pkcs11.CKA_EC_POINT, []byte{0}),
+		pkcs11.NewAttribute(pkcs11.CKA_EC_PARAMS, []byte{0}),
+	}
+
+	if err := ctx.FindObjectsInit(session, findTemplate); err != nil {
+		logrus.Debugf("Failed to init: %s\n", err.Error())
+		return nil, "", err
+	}
+	obj, b, err := ctx.FindObjects(session, 1)
+	if err != nil {
+		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		return nil, "", err
+	}
+	if err := ctx.FindObjectsFinal(session); err != nil {
+		logrus.Debugf("Failed to finalize: %s\n", err.Error())
+		return nil, "", err
+	}
+	if len(obj) != 1 {
+		logrus.Debugf("should have found one object")
+		return nil, "", errors.New("no matching keys found inside of yubikey")
+	}
+
+	// Retrieve the public-key material to be able to create a new HSMRSAKey
+	attr, err := ctx.GetAttributeValue(session, obj[0], attrTemplate)
+	if err != nil {
+		logrus.Debugf("Failed to get Attribute for: %v\n", obj[0])
+		return nil, "", err
+	}
+
+	// Iterate through all the attributes of this key and saves CKA_PUBLIC_EXPONENT and CKA_MODULUS. Removes ordering specific issues.
+	var rawPubKey []byte
+	for _, a := range attr {
+		if a.Type == pkcs11.CKA_EC_POINT {
+			rawPubKey = a.Value
+		}
+
+	}
+
+	ecdsaPubKey := ecdsa.PublicKey{Curve: elliptic.P256(), X: new(big.Int).SetBytes(rawPubKey[3:35]), Y: new(big.Int).SetBytes(rawPubKey[35:])}
+	pubBytes, err := x509.MarshalPKIXPublicKey(&ecdsaPubKey)
+	if err != nil {
+		logrus.Debugf("Failed to Marshal public key")
+		return nil, "", err
+	}
+
+	// TODO(diogo): Actually get the right alias from the certificate instead of
+	// alwars returning data.CanonicalRootRole
+	return data.NewECDSAPublicKey(pubBytes), data.CanonicalRootRole, nil
 }
 
 // Sign returns a signature for a given signature request
-func (s *YubikeyECDSACryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
-	signatures := make([]data.Signature, 0, len(keyIDs))
-	for _, keyid := range keyIDs {
-		key := s.GetKey(keyID)
-		if key == nil {
-			// We skip keys that aren't found
-			continue
-		}
-
-		// Define the ECDSA Private key template
-		class = pkcs11.CKO_PRIVATE_KEY
-		privateKeyTemplate := []*pkcs11.Attribute{
-			pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
-			pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
-			pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{2}),
-		}
-
-		if err := s.context.FindObjectsInit(session, privateKeyTemplate); err != nil {
-			return nil, err
-		}
-		obj, b, err := s.context.FindObjects(session, 1)
-		if err != nil {
-			return nil, err
-		}
-		if err = s.context.FindObjectsFinal(session); e != nil {
-			return nil, err
-		}
-		if len(obj) != 1 {
-			return nil, errors.New("length of objects found not 1")
-		}
-
-		var sig []byte
-		s.context.SignInit(s.session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_ECDSA, nil)}, obj[0])
-
-		// Get the SHA256 of the payload
-		digest := sha256.Sum256(payload)
-
-		sig, err := s.context.Sign(s.session, digest)
-		if err != nil {
-			log.Printf("Error while signing: %s", err)
-			return nil, err
-		}
-
-		if sig == nil {
-			return nil, errors.New("Failed to create signature")
-		}
-
-		signatures = append(signatures, data.Signature{
-			KeyID:     keyid,
-			Method:    data.ECDSASignature,
-			Signature: sig[:],
-		})
+func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID, payload []byte) ([]byte, error) {
+	err := ctx.Login(session, pkcs11.CKU_USER, USER_PIN)
+	if err != nil {
+		return nil, fmt.Errorf("error logging in: %v", err)
 	}
-	return signatures, nil
+	defer ctx.Logout(session)
+
+	// Define the ECDSA Private key template
+	class := pkcs11.CKO_PRIVATE_KEY
+	privateKeyTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
+		pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_ECDSA),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+	}
+
+	if err := ctx.FindObjectsInit(session, privateKeyTemplate); err != nil {
+		return nil, err
+	}
+	obj, _, err := ctx.FindObjects(session, 1)
+	if err != nil {
+		return nil, err
+	}
+	if err = ctx.FindObjectsFinal(session); err != nil {
+		return nil, err
+	}
+	if len(obj) != 1 {
+		return nil, errors.New("length of objects found not 1")
+	}
+
+	var sig []byte
+	ctx.SignInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_ECDSA, nil)}, obj[0])
+
+	// Get the SHA256 of the payload
+	digest := sha256.Sum256(payload)
+
+	sig, err = ctx.Sign(session, digest[:])
+	if err != nil {
+		logrus.Debugf("Error while signing: %s", err)
+		return nil, err
+	}
+
+	if sig == nil {
+		return nil, errors.New("Failed to create signature")
+	}
+	return sig[:], nil
 }
 
-// NewYubikeyECDSACryptoService returns an instance of RSAHardwareCryptoService
-func NewYubikeyECDSACryptoService(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) *YubikeyECDSACryptoService {
-	return &YubikeyECDSACryptoService{
-		context: ctx,
-		session: session,
-	}
+type YubiKeyStore struct{}
+
+func NewYubiKeyStore() *YubiKeyStore {
+	return &YubiKeyStore{}
+}
+
+func (s *YubiKeyStore) ListKeys() map[string]string {
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return nil
+	}
+	defer cleanup(ctx, session)
+	ecdsaPubKey, alias, err := getECDSAKey(ctx, session, YUBIKEY_ROOT_KEY_ID)
+	if err != nil {
+		logrus.Debugf("error while listing keys from Yubikey: %s", err)
+		return nil
+	}
+	return map[string]string{ecdsaPubKey.ID(): alias}
+}
+
+func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) error {
+	// We only allow adding root keys for now
+	if alias != data.CanonicalRootRole {
+		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s\n", alias, keyID)
+	}
+
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return err
+	}
+	defer cleanup(ctx, session)
+
+	return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID)
+}
+
+func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return nil, "", err
+	}
+	defer cleanup(ctx, session)
+
+	pubKey, alias, err := getECDSAKey(ctx, session, YUBIKEY_ROOT_KEY_ID)
+	if err != nil {
+		return nil, "", err
+	}
+	// Check to see if we're returning the intended keyID
+	if pubKey.ID() != keyID {
+		return nil, "", fmt.Errorf("expected root key: %s, but found: %s\n", keyID, pubKey.ID())
+	}
+	privKey := NewYubiPrivateKey(*pubKey)
+	if privKey == nil {
+		return nil, "", errors.New("could not initialize new YubiPrivateKey")
+	}
+
+	return privKey, alias, err
+}
+
+func (s *YubiKeyStore) RemoveKey(keyID string) error {
+	// TODO(diogo): actually implement this
+	logrus.Debugf("Attempting to remove: %s key inside of YubiKeyStore", keyID)
+	return nil
+}
+
+func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
+	// TODO(diogo): actually implement this
+	logrus.Debugf("Attempting to export: %s key inside of YubiKeyStore", keyID)
+	return nil, nil
+}
+
+func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
+	// TODO(diogo): actually implement this
+	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyID)
+	return nil
+}
+
+func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
+	fmt.Println("Tearing down yubikey session")
+	ctx.CloseSession(session)
+	ctx.Finalize()
+	ctx.Destroy()
+}
+
+// SetupHSMEnv is a method that depends on the existences
+func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error) {
+	fmt.Println("Setting up Yubikey")
+	p := pkcs11.New(libraryPath)
+
+	if p == nil {
+		return nil, 0, errors.New("Failed to init library")
+	}
+
+	if err := p.Initialize(); err != nil {
+		return nil, 0, fmt.Errorf("Initialize error %s\n", err.Error())
+	}
+
+	slots, err := p.GetSlotList(true)
+	if err != nil {
+		return nil, 0, fmt.Errorf("Failed to list HSM slots %s", err)
+	}
+	// Check to see if we got any slots from the HSM.
+	if len(slots) < 1 {
+		return nil, 0, fmt.Errorf("No HSM Slots found")
+	}
+
+	// CKF_SERIAL_SESSION: TRUE if cryptographic functions are performed in serial with the application; FALSE if the functions may be performed in parallel with the application.
+	// CKF_RW_SESSION: TRUE if the session is read/write; FALSE if the session is read-only
+	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
+	if err != nil {
+		return nil, 0, fmt.Errorf("Failed to Start Session with HSM %s", err)
+	}
+
+	return p, session, nil
 }
diff --git a/signer/api/rsa_hardware_crypto_service.go b/signer/api/rsa_hardware_crypto_service.go
index 5ffe8536d5..8e673be341 100644
--- a/signer/api/rsa_hardware_crypto_service.go
+++ b/signer/api/rsa_hardware_crypto_service.go
@@ -17,7 +17,7 @@ import (
 
 // RSAHardwareCryptoService is an implementation of SigningService
 type RSAHardwareCryptoService struct {
-	keys    map[string]*keys.HSMKey
+	keys    map[string]*keys.HSMRSAKey
 	context *pkcs11.Ctx
 	session pkcs11.SessionHandle
 }
@@ -68,7 +68,7 @@ func (s *RSAHardwareCryptoService) Create(role, algo string) (data.PublicKey, er
 		pkcs11.NewAttribute(pkcs11.CKA_MODULUS, nil),
 	}
 
-	// Retrieve the public-key material to be able to create a new HSMKey
+	// Retrieve the public-key material to be able to create a new HSMRSAKey
 	attr, err := s.context.GetAttributeValue(s.session, pub, template)
 	if err != nil {
 		return nil, errors.New("Failed to get Attribute value.")
@@ -97,7 +97,7 @@ func (s *RSAHardwareCryptoService) Create(role, algo string) (data.PublicKey, er
 	}
 
 	// (diogo): Ideally I would like to return base64 PEM encoded public keys to the client
-	k := keys.NewHSMKey(pubBytes, priv)
+	k := keys.NewHSMRSAKey(pubBytes, priv)
 
 	keyID := k.ID()
 
@@ -190,7 +190,7 @@ func (s *RSAHardwareCryptoService) Sign(keyIDs []string, payload []byte) ([]data
 // NewRSAHardwareCryptoService returns an instance of RSAHardwareCryptoService
 func NewRSAHardwareCryptoService(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) *RSAHardwareCryptoService {
 	return &RSAHardwareCryptoService{
-		keys:    make(map[string]*keys.HSMKey),
+		keys:    make(map[string]*keys.HSMRSAKey),
 		context: ctx,
 		session: session,
 	}
diff --git a/signer/keydbstore.go b/signer/keydbstore/keydbstore.go
similarity index 99%
rename from signer/keydbstore.go
rename to signer/keydbstore/keydbstore.go
index 06576b209a..f99d3e31c3 100644
--- a/signer/keydbstore.go
+++ b/signer/keydbstore/keydbstore.go
@@ -1,4 +1,4 @@
-package signer
+package keydbstore
 
 import (
 	"database/sql"
diff --git a/signer/keydbstore_test.go b/signer/keydbstore/keydbstore_test.go
similarity index 99%
rename from signer/keydbstore_test.go
rename to signer/keydbstore/keydbstore_test.go
index 8e40a8be60..d22e5a590f 100644
--- a/signer/keydbstore_test.go
+++ b/signer/keydbstore/keydbstore_test.go
@@ -1,4 +1,4 @@
-package signer
+package keydbstore
 
 import (
 	"crypto/rand"
diff --git a/signer/keys/keys.go b/signer/keys/keys.go
index 19cb83022e..80396c6939 100644
--- a/signer/keys/keys.go
+++ b/signer/keys/keys.go
@@ -16,49 +16,48 @@ var (
 	ErrFailedKeyGeneration = errors.New("notary-signer: failed to generate new key")
 )
 
-// HSMKey represents the information for an HSMKey with ObjectHandle for private portion
-type HSMKey struct {
-	id        string
-	algorithm data.KeyAlgorithm
-	public    []byte
-	private   pkcs11.ObjectHandle
+// HSMRSAKey represents the information for an HSMRSAKey with ObjectHandle for private portion
+type HSMRSAKey struct {
+	id      string
+	public  []byte
+	private pkcs11.ObjectHandle
 }
 
-// NewHSMKey returns a HSMKey
-func NewHSMKey(public []byte, private pkcs11.ObjectHandle) *HSMKey {
-	return &HSMKey{
+// NewHSMRSAKey returns a HSMRSAKey
+func NewHSMRSAKey(public []byte, private pkcs11.ObjectHandle) *HSMRSAKey {
+	return &HSMRSAKey{
 		public:  public,
 		private: private,
 	}
 }
 
 // Algorithm implements a method of the data.Key interface
-func (k *HSMKey) Algorithm() data.KeyAlgorithm {
-	return k.algorithm
+func (rsa *HSMRSAKey) Algorithm() string {
+	return data.RSAKey
 }
 
 // ID implements a method of the data.Key interface
-func (k *HSMKey) ID() string {
-	if k.id == "" {
-		pubK := data.NewPublicKey(k.algorithm, k.public)
-		k.id = pubK.ID()
+func (rsa *HSMRSAKey) ID() string {
+	if rsa.id == "" {
+		pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
+		rsa.id = pubK.ID()
 	}
-	return k.id
+	return rsa.id
 }
 
 // Public implements a method of the data.Key interface
-func (k *HSMKey) Public() []byte {
-	return k.public
+func (rsa *HSMRSAKey) Public() []byte {
+	return rsa.public
 }
 
 // Private implements a method of the data.PrivateKey interface
-func (k *HSMKey) Private() []byte {
+func (rsa *HSMRSAKey) Private() []byte {
 	// Not possible to return private key bytes from a hardware device
 	return nil
 }
 
-// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMKey
+// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMRSAKey
 // structure
-func (k *HSMKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
-	return k.private
+func (rsa *HSMRSAKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
+	return rsa.private
 }
diff --git a/tuf/data/keys.go b/tuf/data/keys.go
index be5e297f42..22a1fb786c 100644
--- a/tuf/data/keys.go
+++ b/tuf/data/keys.go
@@ -30,6 +30,7 @@ type PrivateKey interface {
 	Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) (signature []byte, err error)
 	Private() []byte
 	CryptoSigner() crypto.Signer
+	SignatureAlgorithm() SigAlgorithm
 }
 
 // KeyPair holds the public and private key bytes
@@ -485,6 +486,22 @@ func (k UnknownPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOp
 	return nil, errors.New("Unknown key type, cannot sign.")
 }
 
+func (k ECDSAPrivateKey) SignatureAlgorithm() SigAlgorithm {
+	return ECDSASignature
+}
+
+func (k RSAPrivateKey) SignatureAlgorithm() SigAlgorithm {
+	return RSAPSSSignature
+}
+
+func (k ED25519PrivateKey) SignatureAlgorithm() SigAlgorithm {
+	return EDDSASignature
+}
+
+func (k UnknownPrivateKey) SignatureAlgorithm() SigAlgorithm {
+	return ""
+}
+
 // PublicKeyFromPrivate returns a new tufKey based on a private key, with
 // the private key bytes guaranteed to be nil.
 func PublicKeyFromPrivate(pk PrivateKey) PublicKey {

From 4648666b7cfd50f419e1acc40313e19a9e540652 Mon Sep 17 00:00:00 2001
From: Jessica Frazelle <acidburn@docker.com>
Date: Fri, 30 Oct 2015 15:07:39 -0700
Subject: [PATCH 03/85] add pkcs11 build tags

Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Jessica Frazelle <acidburn@docker.com> (github: endophage)
---
 client/client.go                            | 40 ----------------
 client/repo.go                              | 50 ++++++++++++++++++++
 client/repo_pkcs11.go                       | 52 +++++++++++++++++++++
 signer/api/ecdsa_hardware_crypto_service.go |  1 +
 4 files changed, 103 insertions(+), 40 deletions(-)
 create mode 100644 client/repo.go
 create mode 100644 client/repo_pkcs11.go

diff --git a/client/client.go b/client/client.go
index 36a361d2a6..6bd95d7f82 100644
--- a/client/client.go
+++ b/client/client.go
@@ -14,8 +14,6 @@ import (
 	"github.com/docker/notary/client/changelist"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
-	"github.com/docker/notary/pkg/passphrase"
-	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf"
 	tufclient "github.com/docker/notary/tuf/client"
@@ -98,44 +96,6 @@ func NewTarget(targetName string, targetPath string) (*Target, error) {
 	return &Target{Name: targetName, Hashes: meta.Hashes, Length: meta.Length}, nil
 }
 
-// NewNotaryRepository is a helper method that returns a new notary repository.
-// It takes the base directory under where all the trust files will be stored
-// (usually ~/.docker/trust/).
-func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
-
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, passphraseRetriever)
-	if err != nil {
-		return nil, err
-	}
-
-	yubiKeyStore := api.NewYubiKeyStore()
-	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
-
-	nRepo := &NotaryRepository{
-		gun:             gun,
-		baseDir:         baseDir,
-		baseURL:         baseURL,
-		tufRepoPath:     filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),
-		CryptoService:   cryptoService,
-		roundTrip:       rt,
-		KeyStoreManager: keyStoreManager,
-	}
-
-	fileStore, err := store.NewFilesystemStore(
-		nRepo.tufRepoPath,
-		"metadata",
-		"json",
-		"",
-	)
-	if err != nil {
-		return nil, err
-	}
-	nRepo.fileStore = fileStore
-
-	return nRepo, nil
-}
-
 // Initialize creates a new repository by using rootKey as the root Key for the
 // TUF repository.
 func (r *NotaryRepository) Initialize(rootKeyID string) error {
diff --git a/client/repo.go b/client/repo.go
new file mode 100644
index 0000000000..4e7f2a406c
--- /dev/null
+++ b/client/repo.go
@@ -0,0 +1,50 @@
+// +build !pkcs11
+
+package client
+
+import (
+	"net/http"
+	"path/filepath"
+
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/keystoremanager"
+	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/tuf/store"
+)
+
+// NewNotaryRepository is a helper method that returns a new notary repository.
+// It takes the base directory under where all the trust files will be stored
+// (usually ~/.docker/trust/).
+func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
+	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
+
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, passphraseRetriever)
+	if err != nil {
+		return nil, err
+	}
+
+	cryptoService := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
+
+	nRepo := &NotaryRepository{
+		gun:             gun,
+		baseDir:         baseDir,
+		baseURL:         baseURL,
+		tufRepoPath:     filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),
+		CryptoService:   cryptoService,
+		roundTrip:       rt,
+		KeyStoreManager: keyStoreManager,
+	}
+
+	fileStore, err := store.NewFilesystemStore(
+		nRepo.tufRepoPath,
+		"metadata",
+		"json",
+		"",
+	)
+	if err != nil {
+		return nil, err
+	}
+	nRepo.fileStore = fileStore
+
+	return nRepo, nil
+}
diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
new file mode 100644
index 0000000000..ab59f39585
--- /dev/null
+++ b/client/repo_pkcs11.go
@@ -0,0 +1,52 @@
+// +build pkcs11
+
+package client
+
+import (
+	"net/http"
+	"path/filepath"
+
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/keystoremanager"
+	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/tuf/store"
+)
+
+// NewNotaryRepository is a helper method that returns a new notary repository.
+// It takes the base directory under where all the trust files will be stored
+// (usually ~/.docker/trust/).
+func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
+	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
+
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, passphraseRetriever)
+	if err != nil {
+		return nil, err
+	}
+
+	yubiKeyStore := api.NewYubiKeyStore()
+	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
+
+	nRepo := &NotaryRepository{
+		gun:             gun,
+		baseDir:         baseDir,
+		baseURL:         baseURL,
+		tufRepoPath:     filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),
+		CryptoService:   cryptoService,
+		roundTrip:       rt,
+		KeyStoreManager: keyStoreManager,
+	}
+
+	fileStore, err := store.NewFilesystemStore(
+		nRepo.tufRepoPath,
+		"metadata",
+		"json",
+		"",
+	)
+	if err != nil {
+		return nil, err
+	}
+	nRepo.fileStore = fileStore
+
+	return nRepo, nil
+}
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index b025900d0f..a76d21e8b1 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -1,4 +1,5 @@
 // +build pkcs11
+
 package api
 
 import (

From 53ed60ed897ab9d3fcdbeb5c68497643786f6d43 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Fri, 30 Oct 2015 15:38:57 -0700
Subject: [PATCH 04/85] Adding mandatory touch for signatures

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 signer/api/ecdsa_hardware_crypto_service.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index a76d21e8b1..25ce36f85a 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -124,6 +124,10 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
 		pkcs11.NewAttribute(pkcs11.CKA_EC_PARAMS, []byte{0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07}),
 		pkcs11.NewAttribute(pkcs11.CKA_VALUE, ecdsaPrivKeyD),
+		// 1 is touch enabled
+		// 2 is pin once
+		// 4 is pin always
+		pkcs11.NewAttribute(pkcs11.CKA_VENDOR_DEFINED, 3),
 	}
 
 	fmt.Println("About to import the certificate")

From 07f00651522a7eea97f7f0836b1ae194291bdde2 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Fri, 30 Oct 2015 16:23:56 -0700
Subject: [PATCH 05/85] ask for pin when signing Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 client/client.go                            | 48 ++++++++++++-
 cmd/notary/cert.go                          | 15 ++++-
 cmd/notary/keys.go                          | 50 ++++++++++++--
 keystoremanager/import_export.go            | 14 ++--
 keystoremanager/keystoremanager.go          | 11 +--
 keystoremanager/keystoremanager_test.go     | 13 +++-
 signer/api/ecdsa_hardware_crypto_service.go | 75 +++++++++++++++++----
 7 files changed, 184 insertions(+), 42 deletions(-)

diff --git a/client/client.go b/client/client.go
index 6bd95d7f82..eb43189a00 100644
--- a/client/client.go
+++ b/client/client.go
@@ -24,7 +24,9 @@ import (
 	"github.com/docker/notary/tuf/store"
 )
 
-const maxSize = 5 << 20
+const (
+	maxSize = 5 << 20
+)
 
 func init() {
 	data.SetDefaultExpiryTimes(
@@ -96,6 +98,50 @@ func NewTarget(targetName string, targetPath string) (*Target, error) {
 	return &Target{Name: targetName, Hashes: meta.Hashes, Length: meta.Length}, nil
 }
 
+// NewNotaryRepository is a helper method that returns a new notary repository.
+// It takes the base directory under where all the trust files will be stored
+// (usually ~/.docker/trust/).
+func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
+	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
+
+	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	if err != nil {
+		return nil, err
+	}
+
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
+	if err != nil {
+		return nil, err
+	}
+
+	yubiKeyStore := api.NewYubiKeyStore(passphraseRetriever)
+	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, fileKeyStore)
+
+	nRepo := &NotaryRepository{
+		gun:             gun,
+		baseDir:         baseDir,
+		baseURL:         baseURL,
+		tufRepoPath:     filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),
+		CryptoService:   cryptoService,
+		roundTrip:       rt,
+		KeyStoreManager: keyStoreManager,
+	}
+
+	fileStore, err := store.NewFilesystemStore(
+		nRepo.tufRepoPath,
+		"metadata",
+		"json",
+		"",
+	)
+	if err != nil {
+		return nil, err
+	}
+	nRepo.fileStore = fileStore
+
+	return nRepo, nil
+}
+
 // Initialize creates a new repository by using rootKey as the root Key for the
 // TUF repository.
 func (r *NotaryRepository) Initialize(rootKeyID string) error {
diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index 5b76397515..21223bcf8a 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/docker/notary/keystoremanager"
@@ -55,7 +56,12 @@ func certRemove(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -119,7 +125,12 @@ func certList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 04db681393..7cc2297e48 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -11,6 +11,7 @@ import (
 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/trustmanager"
 
 	"github.com/spf13/cobra"
 )
@@ -111,7 +112,12 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -167,7 +173,12 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -220,7 +231,12 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -244,7 +260,12 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -287,7 +308,12 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -322,7 +348,12 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
@@ -351,7 +382,12 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, retriever)
+	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		fatalf("failed to create private key store in directory: %s", keysPath)
+	}
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
diff --git a/keystoremanager/import_export.go b/keystoremanager/import_export.go
index ce099f738f..6fd4735e3e 100644
--- a/keystoremanager/import_export.go
+++ b/keystoremanager/import_export.go
@@ -60,7 +60,7 @@ func (km *KeyStoreManager) ExportRootKeyReencrypt(dest io.Writer, keyID string,
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)
 
-	tempKeysPath := filepath.Join(tempBaseDir, privDir)
+	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
 	if err != nil {
 		return err
@@ -178,7 +178,7 @@ func (km *KeyStoreManager) ExportAllKeys(dest io.Writer, newPassphraseRetriever
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, privDir)
+	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
 	if err != nil {
 		return err
@@ -190,7 +190,7 @@ func (km *KeyStoreManager) ExportAllKeys(dest io.Writer, newPassphraseRetriever
 
 	zipWriter := zip.NewWriter(dest)
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, privDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore, PrivDir); err != nil {
 		return err
 	}
 
@@ -224,14 +224,14 @@ func (km *KeyStoreManager) ImportKeysZip(zipReader zip.Reader) error {
 
 		// Note that using / as a separator is okay here - the zip
 		// package guarantees that the separator will be /
-		if strings.HasPrefix(fNameTrimmed, privDir) {
+		if strings.HasPrefix(fNameTrimmed, PrivDir) {
 			if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
 				if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
 					rc.Close()
 					return err
 				}
 			}
-			keyName := strings.TrimPrefix(fNameTrimmed, privDir)
+			keyName := strings.TrimPrefix(fNameTrimmed, PrivDir)
 			newKeys[keyName] = fileBytes
 		} else {
 			// This path inside the zip archive doesn't look like a
@@ -283,7 +283,7 @@ func (km *KeyStoreManager) ExportKeysByGUN(dest io.Writer, gun string, passphras
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, privDir)
+	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, passphraseRetriever)
 	if err != nil {
 		return err
@@ -299,7 +299,7 @@ func (km *KeyStoreManager) ExportKeysByGUN(dest io.Writer, gun string, passphras
 		return ErrNoKeysFoundForGUN
 	}
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, privDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore, PrivDir); err != nil {
 		return err
 	}
 
diff --git a/keystoremanager/keystoremanager.go b/keystoremanager/keystoremanager.go
index 58cb5b6bc3..09f336de0b 100644
--- a/keystoremanager/keystoremanager.go
+++ b/keystoremanager/keystoremanager.go
@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/docker/notary/pkg/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/tuf/signed"
@@ -26,7 +25,7 @@ type KeyStoreManager struct {
 
 const (
 	trustDir       = "trusted_certificates"
-	privDir        = "private"
+	PrivDir        = "private"
 	rsaRootKeySize = 4096 // Used for new root keys
 )
 
@@ -56,13 +55,7 @@ func (err ErrRootRotationFail) Error() string {
 
 // NewKeyStoreManager returns an initialized KeyStoreManager, or an error
 // if it fails to create the KeyFileStores or load certificates
-func NewKeyStoreManager(baseDir string, passphraseRetriever passphrase.Retriever) (*KeyStoreManager, error) {
-	keysPath := filepath.Join(baseDir, privDir)
-	keyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-	if err != nil {
-		return nil, err
-	}
-
+func NewKeyStoreManager(baseDir string, keyStore *trustmanager.KeyFileStore) (*KeyStoreManager, error) {
 	trustPath := filepath.Join(baseDir, trustDir)
 
 	// Load all CAs that aren't expired and don't use SHA1
diff --git a/keystoremanager/keystoremanager_test.go b/keystoremanager/keystoremanager_test.go
index 075689c6f0..bae645bdac 100644
--- a/keystoremanager/keystoremanager_test.go
+++ b/keystoremanager/keystoremanager_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"testing"
 	"text/template"
 
@@ -121,8 +122,12 @@ func TestValidateRoot(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
+	keysPath := filepath.Join(tempBaseDir, PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	assert.NoError(t, err)
+
 	// Create a FileStoreManager
-	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, passphraseRetriever)
+	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
 	assert.NoError(t, err)
 
 	// Execute our template
@@ -229,8 +234,12 @@ func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
 	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
+	keysPath := filepath.Join(tempBaseDir, PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	assert.NoError(t, err)
+
 	// Create a FileStoreManager
-	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, passphraseRetriever)
+	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
 	assert.NoError(t, err)
 
 	certs := make([]*x509.Certificate, 2)
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 25ce36f85a..8c37feaea3 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -15,13 +15,17 @@ import (
 	"math/big"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/notary/pkg/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/miekg/pkcs11"
 )
 
-const pkcs11Lib = "/usr/local/lib/libykcs11.so"
-const USER_PIN = "123456"
+const (
+	pkcs11Lib   = "/usr/local/lib/libykcs11.so"
+	USER_PIN    = "123456"
+	SO_USER_PIN = "010203040506070801020304050607080102030405060708"
+)
 
 // Hardcoded yubikey PKCS11 ID
 var YUBIKEY_ROOT_KEY_ID = []byte{2}
@@ -29,14 +33,18 @@ var YUBIKEY_ROOT_KEY_ID = []byte{2}
 // YubiPrivateKey represents a private key inside of a yubikey
 type YubiPrivateKey struct {
 	data.ECDSAPublicKey
+	passRetriever passphrase.Retriever
 }
 
 type YubikeySigner struct {
 	YubiPrivateKey
 }
 
-func NewYubiPrivateKey(pubKey data.ECDSAPublicKey) *YubiPrivateKey {
-	return &YubiPrivateKey{ECDSAPublicKey: pubKey}
+func NewYubiPrivateKey(pubKey data.ECDSAPublicKey, passRetriever passphrase.Retriever) *YubiPrivateKey {
+	return &YubiPrivateKey{
+		ECDSAPublicKey: pubKey,
+		passRetriever:  passRetriever,
+	}
 }
 
 func (ys *YubikeySigner) Public() crypto.PublicKey {
@@ -72,7 +80,7 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 	}
 	defer cleanup(ctx, session)
 
-	sig, err := sign(ctx, session, YUBIKEY_ROOT_KEY_ID, msg)
+	sig, err := sign(ctx, session, YUBIKEY_ROOT_KEY_ID, y.passRetriever, msg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to sign using Yubikey: %v", err)
 	}
@@ -81,11 +89,11 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 }
 
 // addECDSAKey adds a key to the yubikey
-func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte) error {
+func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever) error {
 	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
 
 	// TODO(diogo): Figure out CKU_SO with yubikey
-	err := ctx.Login(session, pkcs11.CKU_SO, "010203040506070801020304050607080102030405060708")
+	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN)
 	if err != nil {
 		return err
 	}
@@ -206,8 +214,8 @@ func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []by
 }
 
 // Sign returns a signature for a given signature request
-func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID, payload []byte) ([]byte, error) {
-	err := ctx.Login(session, pkcs11.CKU_USER, USER_PIN)
+func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) {
+	err := login(ctx, session, passRetriever, pkcs11.CKU_USER, USER_PIN)
 	if err != nil {
 		return nil, fmt.Errorf("error logging in: %v", err)
 	}
@@ -253,10 +261,12 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID, payload []
 	return sig[:], nil
 }
 
-type YubiKeyStore struct{}
+type YubiKeyStore struct {
+	passRetriever passphrase.Retriever
+}
 
-func NewYubiKeyStore() *YubiKeyStore {
-	return &YubiKeyStore{}
+func NewYubiKeyStore(passphraseRetriever passphrase.Retriever) *YubiKeyStore {
+	return &YubiKeyStore{passRetriever: passphraseRetriever}
 }
 
 func (s *YubiKeyStore) ListKeys() map[string]string {
@@ -285,7 +295,7 @@ func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) erro
 	}
 	defer cleanup(ctx, session)
 
-	return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID)
+	return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID, s.passRetriever)
 }
 
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
@@ -303,7 +313,7 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	if pubKey.ID() != keyID {
 		return nil, "", fmt.Errorf("expected root key: %s, but found: %s\n", keyID, pubKey.ID())
 	}
-	privKey := NewYubiPrivateKey(*pubKey)
+	privKey := NewYubiPrivateKey(*pubKey, s.passRetriever)
 	if privKey == nil {
 		return nil, "", errors.New("could not initialize new YubiPrivateKey")
 	}
@@ -367,3 +377,40 @@ func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error)
 
 	return p, session, nil
 }
+
+func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphrase.Retriever, userFlag uint, defaultPassw string) error {
+	// try default password
+	err := ctx.Login(session, userFlag, defaultPassw)
+	if err == nil {
+		return nil
+	}
+
+	// default failed, ask user for password
+	for attempts := 0; ; attempts++ {
+		var (
+			giveup bool
+			err    error
+			user   string
+		)
+		if userFlag == pkcs11.CKU_SO {
+			user = "SO Pin"
+		} else {
+			user = "Pin"
+		}
+		passwd, giveup, err := passRetriever(user, "yubikey", false, attempts)
+		// Check if the passphrase retriever got an error or if it is telling us to give up
+		if giveup || err != nil {
+			return trustmanager.ErrPasswordInvalid{}
+		}
+		if attempts > 2 {
+			return trustmanager.ErrAttemptsExceeded{}
+		}
+
+		// Try to convert PEM encoded bytes back to a PrivateKey using the passphrase
+		err = ctx.Login(session, userFlag, passwd)
+		if err == nil {
+			return nil
+		}
+	}
+	return nil
+}

From b59225297a2c70ab190fea63c1186011d4e3a113 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Fri, 30 Oct 2015 17:05:33 -0700
Subject: [PATCH 06/85] Fixing makefile

Signed-off-by: Diogo Monica <diogo@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 Makefile              | 13 +++++++------
 client/repo.go        | 11 +++++++++--
 client/repo_pkcs11.go | 12 ++++++++----
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/Makefile b/Makefile
index 6516d5d4a4..745789ef39 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,7 @@ GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"
 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"
 GOOSES = darwin freebsd linux
 GOARCHS = amd64
+NOTARY_BUILDFLAGS="pkcs11"
 GO_EXC = go
 NOTARYDIR := /go/src/github.com/docker/notary
 
@@ -49,15 +50,15 @@ version/version.go:
 
 ${PREFIX}/bin/notary-server: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -o $@ ${GO_LDFLAGS} ./cmd/notary-server
+	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-server
 
 ${PREFIX}/bin/notary: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -o $@ ${GO_LDFLAGS} ./cmd/notary
+	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary
 
 ${PREFIX}/bin/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -o $@ ${GO_LDFLAGS} ./cmd/notary-signer
+	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-signer
 
 vet: go_version
 	@echo "+ $@"
@@ -73,16 +74,16 @@ lint:
 
 build: go_version
 	@echo "+ $@"
-	@go build -v ${GO_LDFLAGS} ./...
+	@go build -tags ${NOTARY_BUILDFLAGS} -v ${GO_LDFLAGS} ./...
 
 test: OPTS =
 test: go_version
 	@echo "+ $@ $(OPTS)"
-	go test $(OPTS) ./...
+	go test -tags ${NOTARY_BUILDFLAGS} $(OPTS) ./...
 
 test-full: vet lint
 	@echo "+ $@"
-	go test -v ./...
+	go test -tags ${NOTARY_BUILDFLAGS} -v ./...
 
 protos:
 	@protoc --go_out=plugins=grpc:. proto/*.proto
diff --git a/client/repo.go b/client/repo.go
index 4e7f2a406c..35820d09a1 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -3,12 +3,14 @@
 package client
 
 import (
+	"fmt"
 	"net/http"
 	"path/filepath"
 
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/store"
 )
 
@@ -16,9 +18,14 @@ import (
 // It takes the base directory under where all the trust files will be stored
 // (usually ~/.docker/trust/).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
+	retriever passphrase.Retriever) (*NotaryRepository, error) {
+	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
+	}
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, passphraseRetriever)
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
 	if err != nil {
 		return nil, err
 	}
diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index ab59f39585..45c91cf0e2 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -3,6 +3,7 @@
 package client
 
 import (
+	"fmt"
 	"net/http"
 	"path/filepath"
 
@@ -10,6 +11,7 @@ import (
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/pkg/passphrase"
 	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/store"
 )
 
@@ -17,14 +19,16 @@ import (
 // It takes the base directory under where all the trust files will be stored
 // (usually ~/.docker/trust/).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
+	retriever passphrase.Retriever) (*NotaryRepository, error) {
 
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, passphraseRetriever)
+	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
 	}
 
-	yubiKeyStore := api.NewYubiKeyStore()
+	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
+	yubiKeyStore := api.NewYubiKeyStore(retriever)
 	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
 
 	nRepo := &NotaryRepository{

From af1bf0c1d5bbebf97517cd1357a3a763af3e5c20 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Fri, 30 Oct 2015 18:09:13 -0700
Subject: [PATCH 07/85] Removing debug adding pcs11 to makefiles

Signed-off-by: Diogo Monica <diogo@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 Dockerfile.server                           | 1 +
 Dockerfile.signer                           | 1 +
 signer/api/ecdsa_hardware_crypto_service.go | 7 -------
 3 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/Dockerfile.server b/Dockerfile.server
index 9e78872d62..be430f778b 100644
--- a/Dockerfile.server
+++ b/Dockerfile.server
@@ -15,6 +15,7 @@ COPY . /go/src/github.com/docker/notary
 WORKDIR /go/src/${NOTARYPKG}
 
 RUN go install \
+    -tags pkcs11 \
     -ldflags "-w -X ${NOTARYPKG}/version.GitCommit=`git rev-parse --short HEAD` -X ${NOTARYPKG}/version.NotaryVersion=`cat NOTARY_VERSION`" \
     ${NOTARYPKG}/cmd/notary-server
 
diff --git a/Dockerfile.signer b/Dockerfile.signer
index 1d82a99eb2..e4400bdbb0 100644
--- a/Dockerfile.signer
+++ b/Dockerfile.signer
@@ -32,6 +32,7 @@ WORKDIR /go/src/${NOTARYPKG}
 
 # Install notary-signer
 RUN go install \
+    -tags pkcs11 \
     -ldflags "-w -X ${NOTARYPKG}/version.GitCommit=`git rev-parse --short HEAD` -X ${NOTARYPKG}/version.NotaryVersion=`cat NOTARY_VERSION`" \
     ${NOTARYPKG}/cmd/notary-signer
 
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 8c37feaea3..8029241d82 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -99,7 +99,6 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 	}
 	defer ctx.Logout(session)
 
-	fmt.Println("Parsing EC private key")
 	// Create an ecdsa.PrivateKey out of the private key bytes
 	ecdsaPrivKey, err := x509.ParseECPrivateKey(privKey.Private())
 	if err != nil {
@@ -118,7 +117,6 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 	if err != nil {
 		return fmt.Errorf("failed to create the certificate: %v", err)
 	}
-	fmt.Println("Got a certificate!")
 
 	certTemplate := []*pkcs11.Attribute{
 		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE),
@@ -138,14 +136,11 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 		pkcs11.NewAttribute(pkcs11.CKA_VENDOR_DEFINED, 3),
 	}
 
-	fmt.Println("About to import the certificate")
-
 	_, err = ctx.CreateObject(session, certTemplate)
 	if err != nil {
 		return fmt.Errorf("error importing: %v", err)
 	}
 
-	fmt.Println("About to import the private key")
 	_, err = ctx.CreateObject(session, privateKeyTemplate)
 	if err != nil {
 		return fmt.Errorf("error importing: %v", err)
@@ -340,7 +335,6 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
 }
 
 func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
-	fmt.Println("Tearing down yubikey session")
 	ctx.CloseSession(session)
 	ctx.Finalize()
 	ctx.Destroy()
@@ -348,7 +342,6 @@ func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
 
 // SetupHSMEnv is a method that depends on the existences
 func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error) {
-	fmt.Println("Setting up Yubikey")
 	p := pkcs11.New(libraryPath)
 
 	if p == nil {

From 913c5ef0336fddc2656555749268eeb9856964a6 Mon Sep 17 00:00:00 2001
From: Jessica Frazelle <acidburn@docker.com>
Date: Fri, 30 Oct 2015 20:15:31 -0700
Subject: [PATCH 08/85] add build tag files for pkcs11 dlopen lib

Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Jessica Frazelle <acidburn@docker.com> (github: endophage)
---
 signer/api/ecdsa_hardware_crypto_service.go |  1 -
 signer/api/pkcs11_darwin.go                 | 12 ++++++++++++
 signer/api/pkcs11_linux.go                  | 12 ++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 signer/api/pkcs11_darwin.go
 create mode 100644 signer/api/pkcs11_linux.go

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 8029241d82..4b68240f0a 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -22,7 +22,6 @@ import (
 )
 
 const (
-	pkcs11Lib   = "/usr/local/lib/libykcs11.so"
 	USER_PIN    = "123456"
 	SO_USER_PIN = "010203040506070801020304050607080102030405060708"
 )
diff --git a/signer/api/pkcs11_darwin.go b/signer/api/pkcs11_darwin.go
new file mode 100644
index 0000000000..eba8a4ee2c
--- /dev/null
+++ b/signer/api/pkcs11_darwin.go
@@ -0,0 +1,12 @@
+// +build pkcs11,darwin
+
+package api
+
+var (
+	pkcs11Lib = "/usr/local/lib/libykcs11.dylib"
+)
+
+func init() {
+	// TODO(diogomonica): all the crap for darwin to configure
+	// the variable pkcs11 to find the right one in the right dir
+}
diff --git a/signer/api/pkcs11_linux.go b/signer/api/pkcs11_linux.go
new file mode 100644
index 0000000000..acade89b11
--- /dev/null
+++ b/signer/api/pkcs11_linux.go
@@ -0,0 +1,12 @@
+// +build pkcs11,linux
+
+package api
+
+var (
+	pkcs11Lib = "/usr/local/lib/libykcs11.so"
+)
+
+func init() {
+	// TODO(diogomonica): all the crap for linux to configure
+	// the variable pkcs11 to find the right one in the right dir
+}

From 5f21ebd1853d293c5cf328188331627612e2e114 Mon Sep 17 00:00:00 2001
From: Jessica Frazelle <acidburn@docker.com>
Date: Fri, 30 Oct 2015 20:53:10 -0700
Subject: [PATCH 09/85] Add pkcs11 build tags

Add build tags and a check in Makefile to be sure you do not import
pkcs11 lib somewhere where it should not be. This will ensure docker
import and integration will continue to work.

Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Jessica Frazelle <acidburn@docker.com> (github: endophage)
---
 Makefile                                  | 29 +++++++++------
 cmd/notary-signer/main.go                 |  2 ++
 cmd/notary-signer/main_test.go            |  2 ++
 signer/api/api_pkcs11_test.go             | 43 +++++++++++++++++++++++
 signer/api/api_test.go                    | 35 ------------------
 signer/api/rsa_hardware_crypto_service.go |  2 ++
 signer/keys/keys.go                       |  2 ++
 7 files changed, 69 insertions(+), 46 deletions(-)
 create mode 100644 signer/api/api_pkcs11_test.go

diff --git a/Makefile b/Makefile
index 745789ef39..e09918c1a7 100644
--- a/Makefile
+++ b/Makefile
@@ -8,17 +8,25 @@ NOTARY_VERSION := $(shell cat NOTARY_VERSION)
 GITCOMMIT := $(shell git rev-parse --short HEAD)
 GITUNTRACKEDCHANGES := $(shell git status --porcelain --untracked-files=no)
 ifneq ($(GITUNTRACKEDCHANGES),)
-	GITCOMMIT := $(GITCOMMIT)-dirty
+GITCOMMIT := $(GITCOMMIT)-dirty
 endif
 CTIMEVAR=-X $(NOTARY_PKG)/version.GitCommit='$(GITCOMMIT)' -X $(NOTARY_PKG)/version.NotaryVersion='$(NOTARY_VERSION)'
 GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"
 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"
 GOOSES = darwin freebsd linux
 GOARCHS = amd64
-NOTARY_BUILDFLAGS="pkcs11"
+NOTARY_BUILDTAGS="pkcs11"
 GO_EXC = go
 NOTARYDIR := /go/src/github.com/docker/notary
 
+# check to be sure pkcs11 lib is always imported with a build tag
+GO_LIST_PKCS11 := $(shell go list -e -f '{{join .Deps "\n"}}' ./... | xargs go list -e -f '{{if not .Standard}}{{.ImportPath}}{{end}}' | grep -q pkcs11)
+ifeq ($(GO_LIST_PKCS11),)
+$(info pkcs11 import was not found anywhere without a build tag, yay)
+else
+$(error You are importing pkcs11 somewhere and not using a build tag)
+endif
+
 # go cover test variables
 COVERDIR=.cover
 COVERPROFILE=$(COVERDIR)/cover.out
@@ -27,7 +35,7 @@ PKGS = $(shell go list ./... | tr '\n' ' ')
 
 GO_VERSION = $(shell go version | awk '{print $$3}')
 
-.PHONY: clean all fmt vet lint build test binaries cross cover docker-images
+.PHONY: clean all fmt vet lint build test binaries cross cover docker-images notary-dockerfile
 .DELETE_ON_ERROR: cover
 .DEFAULT: default
 
@@ -50,15 +58,15 @@ version/version.go:
 
 ${PREFIX}/bin/notary-server: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-server
+	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-server
 
 ${PREFIX}/bin/notary: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary
+	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary
 
 ${PREFIX}/bin/notary-signer: NOTARY_VERSION $(shell find . -type f -name '*.go')
 	@echo "+ $@"
-	@godep go build -tags ${NOTARY_BUILDFLAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-signer
+	@godep go build -tags ${NOTARY_BUILDTAGS} -o $@ ${GO_LDFLAGS} ./cmd/notary-signer
 
 vet: go_version
 	@echo "+ $@"
@@ -74,21 +82,20 @@ lint:
 
 build: go_version
 	@echo "+ $@"
-	@go build -tags ${NOTARY_BUILDFLAGS} -v ${GO_LDFLAGS} ./...
+	@go build -tags ${NOTARY_BUILDTAGS} -v ${GO_LDFLAGS} ./...
 
 test: OPTS =
 test: go_version
 	@echo "+ $@ $(OPTS)"
-	go test -tags ${NOTARY_BUILDFLAGS} $(OPTS) ./...
+	go test -tags ${NOTARY_BUILDTAGS} $(OPTS) ./...
 
 test-full: vet lint
 	@echo "+ $@"
-	go test -tags ${NOTARY_BUILDFLAGS} -v ./...
+	go test -tags ${NOTARY_BUILDTAGS} -v ./...
 
 protos:
 	@protoc --go_out=plugins=grpc:. proto/*.proto
 
-
 # This allows coverage for a package to come from tests in different package.
 # Requires that the following:
 # go get github.com/wadey/gocovmerge; go install github.com/wadey/gocovmerge
@@ -112,7 +119,7 @@ cover: gen-cover
 	@go tool cover -html="$(COVERPROFILE)"
 
 # Codecov knows how to merge multiple coverage files
-ci: OPTS = -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
+ci: OPTS = -tags ${NOTARY_BUILDTAGS} -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
     GO_EXC := godep go
 ci: gen-cover
 	@gocovmerge $(shell ls -1 $(COVERDIR)/* | tr "\n" " ") > $(COVERPROFILE)
diff --git a/cmd/notary-signer/main.go b/cmd/notary-signer/main.go
index a904ba76ae..5b16c622fa 100644
--- a/cmd/notary-signer/main.go
+++ b/cmd/notary-signer/main.go
@@ -1,3 +1,5 @@
+// +build pkcs11
+
 package main
 
 import (
diff --git a/cmd/notary-signer/main_test.go b/cmd/notary-signer/main_test.go
index 15b2c2ad1e..0864708f78 100644
--- a/cmd/notary-signer/main_test.go
+++ b/cmd/notary-signer/main_test.go
@@ -1,3 +1,5 @@
+// +build pkcs11
+
 package main
 
 import (
diff --git a/signer/api/api_pkcs11_test.go b/signer/api/api_pkcs11_test.go
new file mode 100644
index 0000000000..f73091e916
--- /dev/null
+++ b/signer/api/api_pkcs11_test.go
@@ -0,0 +1,43 @@
+// +build pkcs11
+
+package api_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/miekg/pkcs11"
+)
+
+func SetupHSMEnv(t *testing.T) (*pkcs11.Ctx, pkcs11.SessionHandle) {
+	var libPath = "/usr/local/lib/softhsm/libsofthsm2.so"
+	if _, err := os.Stat(libPath); err != nil {
+		t.Skipf("Skipping test. Library path: %s does not exist", libPath)
+	}
+
+	p := pkcs11.New(libPath)
+
+	if p == nil {
+		t.Fatalf("Failed to init library")
+	}
+
+	if err := p.Initialize(); err != nil {
+		t.Fatalf("Initialize error %s\n", err.Error())
+	}
+
+	slots, err := p.GetSlotList(true)
+	if err != nil {
+		t.Fatalf("Failed to list HSM slots %s", err)
+	}
+
+	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
+	if err != nil {
+		t.Fatalf("Failed to Start Session with HSM %s", err)
+	}
+
+	if err = p.Login(session, pkcs11.CKU_USER, "1234"); err != nil {
+		t.Fatalf("User PIN %s\n", err.Error())
+	}
+
+	return p, session
+}
diff --git a/signer/api/api_test.go b/signer/api/api_test.go
index 4fcf24ea23..729a3aaee7 100644
--- a/signer/api/api_test.go
+++ b/signer/api/api_test.go
@@ -7,7 +7,6 @@ import (
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"strings"
 	"testing"
 
@@ -16,7 +15,6 @@ import (
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
-	"github.com/miekg/pkcs11"
 	"github.com/stretchr/testify/assert"
 
 	pb "github.com/docker/notary/proto"
@@ -32,39 +30,6 @@ var (
 	passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "passphrase", false, nil }
 )
 
-func SetupHSMEnv(t *testing.T) (*pkcs11.Ctx, pkcs11.SessionHandle) {
-	var libPath = "/usr/local/lib/softhsm/libsofthsm2.so"
-	if _, err := os.Stat(libPath); err != nil {
-		t.Skipf("Skipping test. Library path: %s does not exist", libPath)
-	}
-
-	p := pkcs11.New(libPath)
-
-	if p == nil {
-		t.Fatalf("Failed to init library")
-	}
-
-	if err := p.Initialize(); err != nil {
-		t.Fatalf("Initialize error %s\n", err.Error())
-	}
-
-	slots, err := p.GetSlotList(true)
-	if err != nil {
-		t.Fatalf("Failed to list HSM slots %s", err)
-	}
-
-	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-	if err != nil {
-		t.Fatalf("Failed to Start Session with HSM %s", err)
-	}
-
-	if err = p.Login(session, pkcs11.CKU_USER, "1234"); err != nil {
-		t.Fatalf("User PIN %s\n", err.Error())
-	}
-
-	return p, session
-}
-
 func setup(cryptoServices signer.CryptoServiceIndex) {
 	server = httptest.NewServer(api.Handlers(cryptoServices))
 	deleteKeyBaseURL = fmt.Sprintf("%s/delete", server.URL)
diff --git a/signer/api/rsa_hardware_crypto_service.go b/signer/api/rsa_hardware_crypto_service.go
index 8e673be341..640f2891d4 100644
--- a/signer/api/rsa_hardware_crypto_service.go
+++ b/signer/api/rsa_hardware_crypto_service.go
@@ -1,3 +1,5 @@
+// +build pkcs11
+
 package api
 
 import (
diff --git a/signer/keys/keys.go b/signer/keys/keys.go
index 80396c6939..6403c217e2 100644
--- a/signer/keys/keys.go
+++ b/signer/keys/keys.go
@@ -1,3 +1,5 @@
+// +build pkcs11
+
 package keys
 
 import (

From 8902c8c0e99125ea08a10befbc5cf3ac2c0f4ab5 Mon Sep 17 00:00:00 2001
From: Jessica Frazelle <acidburn@docker.com>
Date: Fri, 30 Oct 2015 21:23:55 -0700
Subject: [PATCH 10/85] fix go lint

Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Jessica Frazelle <acidburn@docker.com> (github: endophage)
---
 keystoremanager/keystoremanager.go | 3 ++-
 tuf/data/keys.go                   | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/keystoremanager/keystoremanager.go b/keystoremanager/keystoremanager.go
index 09f336de0b..6b61f1c009 100644
--- a/keystoremanager/keystoremanager.go
+++ b/keystoremanager/keystoremanager.go
@@ -24,7 +24,8 @@ type KeyStoreManager struct {
 }
 
 const (
-	trustDir       = "trusted_certificates"
+	trustDir = "trusted_certificates"
+	// PrivDir is the name of the private directory
 	PrivDir        = "private"
 	rsaRootKeySize = 4096 // Used for new root keys
 )
diff --git a/tuf/data/keys.go b/tuf/data/keys.go
index 22a1fb786c..63582db054 100644
--- a/tuf/data/keys.go
+++ b/tuf/data/keys.go
@@ -486,18 +486,22 @@ func (k UnknownPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOp
 	return nil, errors.New("Unknown key type, cannot sign.")
 }
 
+// SignatureAlgorithm returns the SigAlgorithm for a ECDSAPrivateKey
 func (k ECDSAPrivateKey) SignatureAlgorithm() SigAlgorithm {
 	return ECDSASignature
 }
 
+// SignatureAlgorithm returns the SigAlgorithm for a RSAPrivateKey
 func (k RSAPrivateKey) SignatureAlgorithm() SigAlgorithm {
 	return RSAPSSSignature
 }
 
+// SignatureAlgorithm returns the SigAlgorithm for a ED25519PrivateKey
 func (k ED25519PrivateKey) SignatureAlgorithm() SigAlgorithm {
 	return EDDSASignature
 }
 
+// SignatureAlgorithm returns the SigAlgorithm for an UnknownPrivateKey
 func (k UnknownPrivateKey) SignatureAlgorithm() SigAlgorithm {
 	return ""
 }

From 68992ddaf5bca3f0123eab6c2ae302eb727f6c2c Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Sun, 1 Nov 2015 11:57:56 -0800
Subject: [PATCH 11/85] Resolving rebase conflicts

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 client/client.go | 44 --------------------------------------------
 1 file changed, 44 deletions(-)

diff --git a/client/client.go b/client/client.go
index eb43189a00..ec91fbd272 100644
--- a/client/client.go
+++ b/client/client.go
@@ -98,50 +98,6 @@ func NewTarget(targetName string, targetPath string) (*Target, error) {
 	return &Target{Name: targetName, Hashes: meta.Hashes, Length: meta.Length}, nil
 }
 
-// NewNotaryRepository is a helper method that returns a new notary repository.
-// It takes the base directory under where all the trust files will be stored
-// (usually ~/.docker/trust/).
-func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
-	passphraseRetriever passphrase.Retriever) (*NotaryRepository, error) {
-
-	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-	if err != nil {
-		return nil, err
-	}
-
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
-	if err != nil {
-		return nil, err
-	}
-
-	yubiKeyStore := api.NewYubiKeyStore(passphraseRetriever)
-	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, fileKeyStore)
-
-	nRepo := &NotaryRepository{
-		gun:             gun,
-		baseDir:         baseDir,
-		baseURL:         baseURL,
-		tufRepoPath:     filepath.Join(baseDir, tufDir, filepath.FromSlash(gun)),
-		CryptoService:   cryptoService,
-		roundTrip:       rt,
-		KeyStoreManager: keyStoreManager,
-	}
-
-	fileStore, err := store.NewFilesystemStore(
-		nRepo.tufRepoPath,
-		"metadata",
-		"json",
-		"",
-	)
-	if err != nil {
-		return nil, err
-	}
-	nRepo.fileStore = fileStore
-
-	return nRepo, nil
-}
-
 // Initialize creates a new repository by using rootKey as the root Key for the
 // TUF repository.
 func (r *NotaryRepository) Initialize(rootKeyID string) error {

From 22244fff659886ca7f68b41d8f694b163ef4cddb Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 3 Nov 2015 10:57:56 -0800
Subject: [PATCH 12/85] improve password challenge messaging when using yubikey
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 pkg/passphrase/passphrase.go                | 4 +++-
 signer/api/ecdsa_hardware_crypto_service.go | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkg/passphrase/passphrase.go b/pkg/passphrase/passphrase.go
index 9359e0efc0..b00368fa8e 100644
--- a/pkg/passphrase/passphrase.go
+++ b/pkg/passphrase/passphrase.go
@@ -125,8 +125,10 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 
 		if createNew {
 			fmt.Fprintf(out, "Enter passphrase for new %s key with id %s: ", displayAlias, keyName)
+		} else if displayAlias == "yubikey" {
+			fmt.Fprintf(out, "Enter the %s for the attached Yubikey: ", keyName)
 		} else {
-			fmt.Fprintf(out, "Enter key passphrase for %s key with id %s: ", displayAlias, keyName)
+			fmt.Fprintf(out, "Enter passphrase for %s key with id %s: ", displayAlias, keyName)
 		}
 
 		passphrase, err := stdin.ReadBytes('\n')
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 4b68240f0a..8da450e7d6 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -387,7 +387,7 @@ func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphra
 		if userFlag == pkcs11.CKU_SO {
 			user = "SO Pin"
 		} else {
-			user = "Pin"
+			user = "User Pin"
 		}
 		passwd, giveup, err := passRetriever(user, "yubikey", false, attempts)
 		// Check if the passphrase retriever got an error or if it is telling us to give up

From bc0c0d4ea1d2dc36a696ada0b460b946044f165f Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 3 Nov 2015 10:28:56 -0800
Subject: [PATCH 13/85] health check will never be able to get auth token so
 remove RootHandler wrapper Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 server/server.go | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/server/server.go b/server/server.go
index 66935da786..ca56f359c3 100644
--- a/server/server.go
+++ b/server/server.go
@@ -105,11 +105,8 @@ func RootHandler(ac auth.AccessController, ctx context.Context, trust signed.Cry
 		prometheus.InstrumentHandlerWithOpts(
 			prometheusOpts("DeleteTuf"),
 			hand(handlers.DeleteHandler, "push", "pull")))
-	r.Methods("GET").Path("/_notary_server/health").Handler(hand(
-		func(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
-			health.StatusHandler(w, r)
-			return nil
-		}))
+
+	r.Methods("GET").Path("/_notary_server/health").HandlerFunc(health.StatusHandler)
 	r.Methods("GET").Path("/_notary_server/metrics").Handler(prometheus.Handler())
 	r.Methods("GET", "POST", "PUT", "HEAD", "DELETE").Path("/{other:.*}").Handler(hand(utils.NotFoundHandler))
 

From 519a2ccbe8e24136a2b2a9803a716659fc6acd85 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Mon, 2 Nov 2015 14:18:30 -0800
Subject: [PATCH 14/85] removing all errors that aren't in use, fixing one
 place in memorystore that was using a different errorcode to all other
 stores, pushing errors into appropriate packages Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 client/client.go         |  3 +-
 tuf/client/errors.go     | 70 ----------------------------
 tuf/data/roles.go        | 19 ++++++--
 tuf/errors/errors.go     | 98 ----------------------------------------
 tuf/keys/db.go           |  3 +-
 tuf/signed/errors.go     | 11 +++++
 tuf/signed/sign.go       |  3 +-
 tuf/store/memorystore.go |  3 +-
 tuf/tuf.go               | 11 ++---
 9 files changed, 34 insertions(+), 187 deletions(-)
 delete mode 100644 tuf/errors/errors.go

diff --git a/client/client.go b/client/client.go
index ec91fbd272..b029e4c569 100644
--- a/client/client.go
+++ b/client/client.go
@@ -18,7 +18,6 @@ import (
 	"github.com/docker/notary/tuf"
 	tufclient "github.com/docker/notary/tuf/client"
 	"github.com/docker/notary/tuf/data"
-	tuferrors "github.com/docker/notary/tuf/errors"
 	"github.com/docker/notary/tuf/keys"
 	"github.com/docker/notary/tuf/signed"
 	"github.com/docker/notary/tuf/store"
@@ -174,7 +173,7 @@ func (r *NotaryRepository) Initialize(rootKeyID string) error {
 	if err != nil {
 		logrus.Debug("Error on InitRoot: ", err.Error())
 		switch err.(type) {
-		case tuferrors.ErrInsufficientSignatures, trustmanager.ErrPasswordInvalid:
+		case signed.ErrInsufficientSignatures, trustmanager.ErrPasswordInvalid:
 		default:
 			return err
 		}
diff --git a/tuf/client/errors.go b/tuf/client/errors.go
index 0fb1a8d00c..037b3df00b 100644
--- a/tuf/client/errors.go
+++ b/tuf/client/errors.go
@@ -1,16 +1,9 @@
 package client
 
 import (
-	"errors"
 	"fmt"
 )
 
-// Simple client errors
-var (
-	ErrNoRootKeys       = errors.New("tuf: no root keys found in local meta store")
-	ErrInsufficientKeys = errors.New("tuf: insufficient keys to meet threshold")
-)
-
 // ErrChecksumMismatch - a checksum failed verification
 type ErrChecksumMismatch struct {
 	role string
@@ -29,69 +22,6 @@ func (e ErrMissingMeta) Error() string {
 	return fmt.Sprintf("tuf: sha256 checksum required for %s", e.role)
 }
 
-// ErrMissingRemoteMetadata - remote didn't have requested metadata
-type ErrMissingRemoteMetadata struct {
-	Name string
-}
-
-func (e ErrMissingRemoteMetadata) Error() string {
-	return fmt.Sprintf("tuf: missing remote metadata %s", e.Name)
-}
-
-// ErrDownloadFailed - a download failed
-type ErrDownloadFailed struct {
-	File string
-	Err  error
-}
-
-func (e ErrDownloadFailed) Error() string {
-	return fmt.Sprintf("tuf: failed to download %s: %s", e.File, e.Err)
-}
-
-// ErrDecodeFailed - couldn't parse a download
-type ErrDecodeFailed struct {
-	File string
-	Err  error
-}
-
-func (e ErrDecodeFailed) Error() string {
-	return fmt.Sprintf("tuf: failed to decode %s: %s", e.File, e.Err)
-}
-
-func isDecodeFailedWithErr(err, expected error) bool {
-	e, ok := err.(ErrDecodeFailed)
-	if !ok {
-		return false
-	}
-	return e.Err == expected
-}
-
-// ErrNotFound - didn't find a file
-type ErrNotFound struct {
-	File string
-}
-
-func (e ErrNotFound) Error() string {
-	return fmt.Sprintf("tuf: file not found: %s", e.File)
-}
-
-// IsNotFound - check if an error is an ErrNotFound type
-func IsNotFound(err error) bool {
-	_, ok := err.(ErrNotFound)
-	return ok
-}
-
-// ErrWrongSize - the size is wrong
-type ErrWrongSize struct {
-	File     string
-	Actual   int64
-	Expected int64
-}
-
-func (e ErrWrongSize) Error() string {
-	return fmt.Sprintf("tuf: unexpected file size: %s (expected %d bytes, got %d bytes)", e.File, e.Expected, e.Actual)
-}
-
 // ErrCorruptedCache - local data is incorrect
 type ErrCorruptedCache struct {
 	file string
diff --git a/tuf/data/roles.go b/tuf/data/roles.go
index d2d0063814..0e6541c978 100644
--- a/tuf/data/roles.go
+++ b/tuf/data/roles.go
@@ -3,8 +3,6 @@ package data
 import (
 	"fmt"
 	"strings"
-
-	"github.com/docker/notary/tuf/errors"
 )
 
 // Canonical base role names
@@ -26,6 +24,17 @@ var ValidRoles = map[string]string{
 	CanonicalTimestampRole: CanonicalTimestampRole,
 }
 
+// ErrInvalidRole represents an error regarding a role. Typically
+// something like a role for which sone of the public keys were
+// not found in the TUF repo.
+type ErrInvalidRole struct {
+	Role string
+}
+
+func (e ErrInvalidRole) Error() string {
+	return fmt.Sprintf("tuf: invalid role %s", e.Role)
+}
+
 // SetValidRoles is a utility function to override some or all of the roles
 func SetValidRoles(rs map[string]string) {
 	// iterate ValidRoles
@@ -106,13 +115,13 @@ type Role struct {
 // NewRole creates a new Role object from the given parameters
 func NewRole(name string, threshold int, keyIDs, paths, pathHashPrefixes []string) (*Role, error) {
 	if len(paths) > 0 && len(pathHashPrefixes) > 0 {
-		return nil, errors.ErrInvalidRole{}
+		return nil, ErrInvalidRole{Role: name}
 	}
 	if threshold < 1 {
-		return nil, errors.ErrInvalidRole{}
+		return nil, ErrInvalidRole{Role: name}
 	}
 	if !ValidRole(name) {
-		return nil, errors.ErrInvalidRole{}
+		return nil, ErrInvalidRole{Role: name}
 	}
 	return &Role{
 		RootRole: RootRole{
diff --git a/tuf/errors/errors.go b/tuf/errors/errors.go
deleted file mode 100644
index 763be52fb4..0000000000
--- a/tuf/errors/errors.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package errors
-
-import (
-	"errors"
-	"fmt"
-	"time"
-)
-
-// ErrInitNotAllowed - repo has already been initialized
-var ErrInitNotAllowed = errors.New("tuf: repository already initialized")
-
-// ErrMissingMetadata - cannot find the file meta being requested.
-// Specifically, could not find the FileMeta object in the expected
-// location.
-type ErrMissingMetadata struct {
-	Name string
-}
-
-func (e ErrMissingMetadata) Error() string {
-	return fmt.Sprintf("tuf: missing metadata %s", e.Name)
-}
-
-// ErrFileNotFound - could not find a file
-type ErrFileNotFound struct {
-	Path string
-}
-
-func (e ErrFileNotFound) Error() string {
-	return fmt.Sprintf("tuf: file not found %s", e.Path)
-}
-
-// ErrInsufficientKeys - did not have enough keys to sign when requested
-type ErrInsufficientKeys struct {
-	Name string
-}
-
-func (e ErrInsufficientKeys) Error() string {
-	return fmt.Sprintf("tuf: insufficient keys to sign %s", e.Name)
-}
-
-// ErrInsufficientSignatures - do not have enough signatures on a piece of
-// metadata
-type ErrInsufficientSignatures struct {
-	Name string
-	Err  error
-}
-
-func (e ErrInsufficientSignatures) Error() string {
-	return fmt.Sprintf("tuf: insufficient signatures for %s: %s", e.Name, e.Err)
-}
-
-// ErrInvalidRole - role is wrong. Typically we're missing the public keys for it
-type ErrInvalidRole struct {
-	Role string
-}
-
-func (e ErrInvalidRole) Error() string {
-	return fmt.Sprintf("tuf: invalid role %s", e.Role)
-}
-
-// ErrInvalidExpires - the expiry time for a metadata file is invalid
-type ErrInvalidExpires struct {
-	Expires time.Time
-}
-
-func (e ErrInvalidExpires) Error() string {
-	return fmt.Sprintf("tuf: invalid expires: %s", e.Expires)
-}
-
-// ErrKeyNotFound - could not find a given key on a role
-type ErrKeyNotFound struct {
-	Role  string
-	KeyID string
-}
-
-func (e ErrKeyNotFound) Error() string {
-	return fmt.Sprintf(`tuf: no key with id "%s" exists for the %s role`, e.KeyID, e.Role)
-}
-
-// ErrNotEnoughKeys - there are not enough keys to ever meet the signature threshold
-type ErrNotEnoughKeys struct {
-	Role      string
-	Keys      int
-	Threshold int
-}
-
-func (e ErrNotEnoughKeys) Error() string {
-	return fmt.Sprintf("tuf: %s role has insufficient keys for threshold (has %d keys, threshold is %d)", e.Role, e.Keys, e.Threshold)
-}
-
-// ErrPassphraseRequired - a passphrase is needed and wasn't provided
-type ErrPassphraseRequired struct {
-	Role string
-}
-
-func (e ErrPassphraseRequired) Error() string {
-	return fmt.Sprintf("tuf: a passphrase is required to access the encrypted %s keys file", e.Role)
-}
diff --git a/tuf/keys/db.go b/tuf/keys/db.go
index 30afc8d1dc..2e27d052cd 100644
--- a/tuf/keys/db.go
+++ b/tuf/keys/db.go
@@ -12,7 +12,6 @@ var (
 	ErrExists           = errors.New("tuf: key already in db")
 	ErrWrongID          = errors.New("tuf: key id mismatch")
 	ErrInvalidKey       = errors.New("tuf: invalid key")
-	ErrInvalidRole      = errors.New("tuf: invalid role")
 	ErrInvalidKeyID     = errors.New("tuf: invalid key id")
 	ErrInvalidThreshold = errors.New("tuf: invalid role threshold")
 )
@@ -42,7 +41,7 @@ func (db *KeyDB) AddKey(k data.PublicKey) {
 // role must have already been added.
 func (db *KeyDB) AddRole(r *data.Role) error {
 	if !data.ValidRole(r.Name) {
-		return ErrInvalidRole
+		return data.ErrInvalidRole{Role: r.Name}
 	}
 	if r.Threshold < 1 {
 		return ErrInvalidThreshold
diff --git a/tuf/signed/errors.go b/tuf/signed/errors.go
index 0c92f3465e..c042e60685 100644
--- a/tuf/signed/errors.go
+++ b/tuf/signed/errors.go
@@ -4,6 +4,17 @@ import (
 	"fmt"
 )
 
+// ErrInsufficientSignatures - do not have enough signatures on a piece of
+// metadata
+type ErrInsufficientSignatures struct {
+	Name string
+	Err  error
+}
+
+func (e ErrInsufficientSignatures) Error() string {
+	return fmt.Sprintf("tuf: insufficient signatures for %s: %s", e.Name, e.Err)
+}
+
 // ErrExpired indicates a piece of metadata has expired
 type ErrExpired struct {
 	Role    string
diff --git a/tuf/signed/sign.go b/tuf/signed/sign.go
index c33aa075d4..99987a2fb5 100644
--- a/tuf/signed/sign.go
+++ b/tuf/signed/sign.go
@@ -16,7 +16,6 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/errors"
 	"github.com/docker/notary/tuf/utils"
 )
 
@@ -68,7 +67,7 @@ func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
 		}
 	}
 	if len(signatures) < 1 {
-		return errors.ErrInsufficientSignatures{
+		return ErrInsufficientSignatures{
 			Name: fmt.Sprintf("Cryptoservice failed to produce any signatures for keys with IDs: %v", keyIDs),
 			Err:  nil,
 		}
diff --git a/tuf/store/memorystore.go b/tuf/store/memorystore.go
index 89284a80f2..0e17889891 100644
--- a/tuf/store/memorystore.go
+++ b/tuf/store/memorystore.go
@@ -6,7 +6,6 @@ import (
 	"io"
 
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/errors"
 	"github.com/docker/notary/tuf/utils"
 )
 
@@ -76,7 +75,7 @@ func (m *memoryStore) WalkStagedTargets(paths []string, targetsFn targetsWalkFun
 	for _, path := range paths {
 		dat, ok := m.files[path]
 		if !ok {
-			return errors.ErrFileNotFound{Path: path}
+			return ErrMetaNotFound{}
 		}
 		meta, err := data.NewFileMeta(bytes.NewReader(dat), "sha256")
 		if err != nil {
diff --git a/tuf/tuf.go b/tuf/tuf.go
index 4f7a5ffa59..33dd9448a8 100644
--- a/tuf/tuf.go
+++ b/tuf/tuf.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/errors"
 	"github.com/docker/notary/tuf/keys"
 	"github.com/docker/notary/tuf/signed"
 	"github.com/docker/notary/tuf/utils"
@@ -163,12 +162,12 @@ func (tr *Repo) RemoveBaseKeys(role string, keyIDs ...string) error {
 // A new, empty, targets file will be created for the new role.
 func (tr *Repo) UpdateDelegations(role *data.Role, keys []data.PublicKey, before string) error {
 	if !role.IsDelegation() || !role.IsValid() {
-		return errors.ErrInvalidRole{}
+		return data.ErrInvalidRole{Role: role.Name}
 	}
 	parent := filepath.Dir(role.Name)
 	p, ok := tr.Targets[parent]
 	if !ok {
-		return errors.ErrInvalidRole{}
+		return data.ErrInvalidRole{Role: role.Name}
 	}
 	for _, k := range keys {
 		if !utils.StrSliceContains(role.KeyIDs, k.ID()) {
@@ -225,7 +224,7 @@ func (tr *Repo) InitRoot(consistent bool) error {
 	for _, r := range data.ValidRoles {
 		role := tr.keysDB.GetRole(r)
 		if role == nil {
-			return errors.ErrInvalidRole{}
+			return data.ErrInvalidRole{Role: data.CanonicalRootRole}
 		}
 		rootRoles[r] = &role.RootRole
 		for _, kid := range role.KeyIDs {
@@ -404,7 +403,7 @@ func (tr Repo) FindTarget(path string) *data.FileMeta {
 func (tr *Repo) AddTargets(role string, targets data.Files) (data.Files, error) {
 	t, ok := tr.Targets[role]
 	if !ok {
-		return targets, errors.ErrInvalidRole{Role: role}
+		return targets, data.ErrInvalidRole{Role: role}
 	}
 	invalid := make(data.Files)
 	for path, target := range targets {
@@ -428,7 +427,7 @@ func (tr *Repo) AddTargets(role string, targets data.Files) (data.Files, error)
 func (tr *Repo) RemoveTargets(role string, targets ...string) error {
 	t, ok := tr.Targets[role]
 	if !ok {
-		return errors.ErrInvalidRole{Role: role}
+		return data.ErrInvalidRole{Role: role}
 	}
 
 	for _, path := range targets {

From 2a9e163bd28f90368fd54a38ccdc0ee126f149c1 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 4 Nov 2015 13:39:23 -0800
Subject: [PATCH 15/85] Fixed cryptoservice.Create to call keyStore.AddKey with
 a GUN only if it is not a root role.

Updated the cryptoservice tests to test all key algorithms, all roles,
and cryptoservices without a GUN.  This then also found bugs in
cryptoservice.GetKey, cryptoservice.RemoveKey, and
cryptoservice.GetPrivateKey, which weren't really being exercised
previously.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cryptoservice/certificate_test.go    |   2 +-
 cryptoservice/crypto_service.go      |  65 ++++++------
 cryptoservice/crypto_service_test.go | 148 ++++++++++++++++++++++-----
 3 files changed, 159 insertions(+), 56 deletions(-)

diff --git a/cryptoservice/certificate_test.go b/cryptoservice/certificate_test.go
index 94b0eae8be..a88fa8754b 100644
--- a/cryptoservice/certificate_test.go
+++ b/cryptoservice/certificate_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestUnlockedSigner(t *testing.T) {
+func TestGenerateCertificate(t *testing.T) {
 	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err, "could not generate key")
 
diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index ec0971c34e..61030af0d0 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -53,8 +53,15 @@ func (ccs *CryptoService) Create(role, algorithm string) (data.PublicKey, error)
 	logrus.Debugf("generated new %s key for role: %s and keyID: %s", algorithm, role, privKey.ID())
 
 	// Store the private key into our keystore with the name being: /GUN/ID.key with an alias of role
+	var keyPath string
+	if role == data.CanonicalRootRole {
+		keyPath = privKey.ID()
+	} else {
+		keyPath = filepath.Join(ccs.gun, privKey.ID())
+	}
+
 	for _, ks := range ccs.keyStores {
-		err = ks.AddKey(filepath.Join(ccs.gun, privKey.ID()), role, privKey)
+		err = ks.AddKey(keyPath, role, privKey)
 		if err == nil {
 			return data.PublicKeyFromPrivate(privKey), nil
 		}
@@ -66,40 +73,47 @@ func (ccs *CryptoService) Create(role, algorithm string) (data.PublicKey, error)
 
 }
 
-// GetPrivateKey returns a private key by ID
+// GetPrivateKey returns a private key by ID. It tries to get the key first
+// without a GUN (in which case it's a root key).  If that fails, try to get
+// the key with the GUN (non-root key).
+// If that fails, then we don't have the key.
 func (ccs *CryptoService) GetPrivateKey(keyID string) (k data.PrivateKey, id string, err error) {
+	keyPaths := []string{keyID, filepath.Join(ccs.gun, keyID)}
 	for _, ks := range ccs.keyStores {
-		k, id, err = ks.GetKey(keyID)
-		if k == nil || err != nil {
-			continue
+		for _, keyPath := range keyPaths {
+			k, id, err = ks.GetKey(keyPath)
+			if err != nil {
+				continue
+			}
+			return
 		}
-		return
 	}
 	return // returns whatever the final values were
 }
 
 // GetKey returns a key by ID
 func (ccs *CryptoService) GetKey(keyID string) data.PublicKey {
-	for _, ks := range ccs.keyStores {
-		k, _, err := ks.GetKey(keyID)
-		if k == nil || err != nil {
-			continue
-		}
-		return data.PublicKeyFromPrivate(k)
-
+	privKey, _, err := ccs.GetPrivateKey(keyID)
+	if err != nil {
+		return nil
 	}
-	return nil // returns whatever the final values were
+	return data.PublicKeyFromPrivate(privKey)
 }
 
 // RemoveKey deletes a key by ID
 func (ccs *CryptoService) RemoveKey(keyID string) (err error) {
+	keyPaths := []string{keyID, filepath.Join(ccs.gun, keyID)}
 	for _, ks := range ccs.keyStores {
-		e := ks.RemoveKey(keyID)
-		if e != nil {
-			err = e
+		for _, keyPath := range keyPaths {
+			_, _, err = ks.GetKey(keyPath)
+			if err != nil {
+				continue
+			}
+			err = ks.RemoveKey(keyPath)
+			return
 		}
 	}
-	return // returns last error if any
+	return // returns whatever the final values were
 }
 
 // Sign returns the signatures for the payload with a set of keyIDs. It ignores
@@ -110,25 +124,18 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
 	for _, keyid := range keyIDs {
 		keyName := keyid
 
-		// Try to get the key first without a GUN (in which case it's a root
-		// key).  If that fails, try to get the key with the GUN (non-root
-		// key).  If that fails, then we don't have the key.
 		privKey, _, err := ccs.GetPrivateKey(keyName)
 		if err != nil {
 			logrus.Debugf("error attempting to retrieve private key: %s, %v", keyid, err)
-			keyName = filepath.Join(ccs.gun, keyid)
-			privKey, _, err = ccs.GetPrivateKey(keyName)
-			if err != nil {
-				logrus.Debugf("error attempting to retrieve key ID: %s, %v", keyid, err)
-				return nil, err
-			}
+			continue
 		}
 
 		sigAlgo := privKey.SignatureAlgorithm()
 		sig, err := privKey.Sign(rand.Reader, payload, nil)
 		if err != nil {
-			logrus.Debugf("ignoring error attempting to %s sign with keyID: %s, %v", privKey.Algorithm(), keyid, err)
-			return nil, err
+			logrus.Debugf("ignoring error attempting to %s sign with keyID: %s, %v",
+				privKey.Algorithm(), keyid, err)
+			continue
 		}
 
 		logrus.Debugf("appending %s signature with Key ID: %s", privKey.Algorithm(), keyid)
diff --git a/cryptoservice/crypto_service_test.go b/cryptoservice/crypto_service_test.go
index 4ed3682a79..832197a542 100644
--- a/cryptoservice/crypto_service_test.go
+++ b/cryptoservice/crypto_service_test.go
@@ -1,51 +1,147 @@
 package cryptoservice
 
 import (
-	"github.com/stretchr/testify/assert"
+	"fmt"
+	"runtime"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/tuf/signed"
 )
 
-func TestCryptoService(t *testing.T) {
-	testCryptoService(t, data.ECDSAKey, signed.ECDSAVerifier{})
-	testCryptoService(t, data.ED25519Key, signed.Ed25519Verifier{})
-	if !testing.Short() {
-		testCryptoService(t, data.RSAKey, signed.RSAPSSVerifier{})
-	}
+var algoToSigType = map[string]data.SigAlgorithm{
+	data.ECDSAKey:   data.ECDSASignature,
+	data.ED25519Key: data.EDDSASignature,
+	data.RSAKey:     data.RSAPSSSignature,
 }
 
 var passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "", false, nil }
 
-func testCryptoService(t *testing.T, keyAlgo string, verifier signed.Verifier) {
-	content := []byte("this is a secret")
+type CryptoServiceTester struct {
+	cryptoServiceFactory func() *CryptoService
+	role                 string
+	keyAlgo              string
+}
 
-	keyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
-	cryptoService := NewCryptoService("", keyStore)
+// asserts that created key exists
+func (c CryptoServiceTester) TestCreateAndGetKey(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
 
 	// Test Create
-	tufKey, err := cryptoService.Create("", keyAlgo)
-	assert.NoError(t, err, "error creating key")
-
-	// Test Sign
-	signatures, err := cryptoService.Sign([]string{tufKey.ID()}, content)
-	assert.NoError(t, err, "signing failed")
-	assert.Len(t, signatures, 1, "wrong number of signatures")
-
-	err = verifier.Verify(tufKey, signatures[0].Signature, content)
-	assert.NoError(t, err, "verification failed for %s key type", keyAlgo)
+	tufKey, err := cryptoService.Create(c.role, c.keyAlgo)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
 
 	// Test GetKey
 	retrievedKey := cryptoService.GetKey(tufKey.ID())
-	assert.Equal(t, tufKey.Public(), retrievedKey.Public(), "retrieved key didn't match")
+	assert.NotNil(t, retrievedKey,
+		c.errorMsg("Could not find key ID %s", tufKey.ID()))
+	assert.Equal(t, tufKey.Public(), retrievedKey.Public(),
+		c.errorMsg("retrieved public key didn't match"))
 
-	assert.Nil(t, cryptoService.GetKey("boguskeyid"), "non-nil result for bogus keyid")
+	// Test GetPrivateKey
+	retrievedKey, alias, err := cryptoService.GetPrivateKey(tufKey.ID())
+	assert.NoError(t, err)
+	assert.Equal(t, tufKey.ID(), retrievedKey.ID(),
+		c.errorMsg("retrieved private key didn't have the right ID"))
+	assert.Equal(t, c.role, alias)
+}
+
+// asserts that getting key fails for a non-existent key
+func (c CryptoServiceTester) TestGetNonexistentKey(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+
+	assert.Nil(t, cryptoService.GetKey("boguskeyid"),
+		c.errorMsg("non-nil result for bogus keyid"))
+
+	_, _, err := cryptoService.GetPrivateKey("boguskeyid")
+	assert.NotNil(t, err)
+}
+
+// asserts that signing with a created key creates a valid signature
+func (c CryptoServiceTester) TestSignWithKey(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	content := []byte("this is a secret")
+
+	tufKey, err := cryptoService.Create(c.role, c.keyAlgo)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+
+	// Test Sign
+	signatures, err := cryptoService.Sign([]string{tufKey.ID()}, content)
+	assert.NoError(t, err, c.errorMsg("signing failed"))
+	assert.Len(t, signatures, 1, c.errorMsg("wrong number of signatures"))
+
+	verifier, ok := signed.Verifiers[algoToSigType[c.keyAlgo]]
+	assert.True(t, ok, c.errorMsg("Unknown verifier for algorithm"))
+
+	err = verifier.Verify(tufKey, signatures[0].Signature, content)
+	assert.NoError(t, err,
+		c.errorMsg("verification failed for %s key type", c.keyAlgo))
+}
+
+// asserts that removing key that exists succeeds
+func (c CryptoServiceTester) TestRemoveCreatedKey(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+
+	tufKey, err := cryptoService.Create(c.role, c.keyAlgo)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+	assert.NotNil(t, cryptoService.GetKey(tufKey.ID()))
 
 	// Test RemoveKey
 	err = cryptoService.RemoveKey(tufKey.ID())
-	assert.NoError(t, err, "could not remove key")
-	retrievedKey = cryptoService.GetKey(tufKey.ID())
-	assert.Nil(t, retrievedKey, "remove didn't work")
+	assert.NoError(t, err, c.errorMsg("could not remove key"))
+	retrievedKey := cryptoService.GetKey(tufKey.ID())
+	assert.Nil(t, retrievedKey, c.errorMsg("remove didn't work"))
+}
+
+// Prints out an error message with information about the key algorithm,
+// role, and test name. Ideally we could generate different tests given
+// data, without having to put for loops in one giant test function, but
+// that involves a lot of boilerplate.  So as a compromise, everything will
+// still be run in for loops in one giant test function, but we can at
+// least provide an error message stating what data/helper test function
+// failed.
+func (c CryptoServiceTester) errorMsg(message string, args ...interface{}) string {
+	pc := make([]uintptr, 10) // at least 1 entry needed
+	runtime.Callers(2, pc)    // the caller of errorMsg
+	f := runtime.FuncForPC(pc[0])
+	return fmt.Sprintf("%s (role: %s, keyAlgo: %s): %s", f.Name(), c.role,
+		c.keyAlgo, fmt.Sprintf(message, args...))
+}
+
+func testCryptoService(t *testing.T, gun string) {
+	getCryptoService := func() *CryptoService {
+		return NewCryptoService(
+			gun, trustmanager.NewKeyMemoryStore(passphraseRetriever))
+	}
+	roles := []string{
+		data.CanonicalRootRole,
+		data.CanonicalTargetsRole,
+		data.CanonicalSnapshotRole,
+		data.CanonicalTimestampRole,
+	}
+
+	for _, role := range roles {
+		for algo := range algoToSigType {
+			cst := CryptoServiceTester{
+				cryptoServiceFactory: getCryptoService,
+				role:                 role,
+				keyAlgo:              algo,
+			}
+			cst.TestCreateAndGetKey(t)
+			cst.TestGetNonexistentKey(t)
+			cst.TestSignWithKey(t)
+			cst.TestRemoveCreatedKey(t)
+		}
+	}
+}
+
+func TestCryptoServiceWithNonEmptyGUN(t *testing.T) {
+	testCryptoService(t, "org/repo")
+}
+
+func TestCryptoServiceWithEmptyGUN(t *testing.T) {
+	testCryptoService(t, "")
 }

From 5b6f64de4bd3a381246100f1f53c99f899aac98c Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Thu, 5 Nov 2015 10:46:02 -0800
Subject: [PATCH 16/85] Refactor notary client tests.

Move common code out into helper functions, and split up the bigger tests
into tests that specifically test adding targets, getting changelists,
publishing, and listing, as opposed to having two giant tests instead.

Also depend more on existing functions in the code (such as
NotaryRepository.GetChangelists and the server ServerMux), rather than
reimplementing them in the tests.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 client/client_root_validation_test.go |  67 +--
 client/client_test.go                 | 575 ++++++++++++--------------
 2 files changed, 265 insertions(+), 377 deletions(-)

diff --git a/client/client_root_validation_test.go b/client/client_root_validation_test.go
index 1bc8763c99..752adbe4bc 100644
--- a/client/client_root_validation_test.go
+++ b/client/client_root_validation_test.go
@@ -1,12 +1,8 @@
 package client
 
 import (
-	"encoding/json"
-	"fmt"
 	"io/ioutil"
-	"net/http"
 	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/Sirupsen/logrus"
@@ -37,17 +33,10 @@ func validateRootSuccessfully(t *testing.T, rootType string) {
 
 	gun := "docker.com/notary"
 
-	ts, mux := createTestServer(t)
+	ts, mux := simpleTestServer(t)
 	defer ts.Close()
 
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
 	// tests need to manually boostrap timestamp as client doesn't generate it
 	err = repo.tufRepo.InitTimestamp()
@@ -58,50 +47,7 @@ func validateRootSuccessfully(t *testing.T, rootType string) {
 	allCerts := repo.KeyStoreManager.TrustedCertificateStore().GetCertificates()
 	assert.Len(t, allCerts, 1)
 
-	// Now test ListTargets. In preparation, we need to expose some signed
-	// metadata files on the internal HTTP server.
-	tempKey, err := data.UnmarshalPrivateKey([]byte(timestampECDSAKeyJSON))
-	assert.NoError(t, err)
-
-	repo.KeyStoreManager.KeyStore.AddKey(filepath.Join(filepath.FromSlash(gun), tempKey.ID()), "root", tempKey)
-
-	// Because ListTargets will clear this
-	savedTUFRepo := repo.tufRepo
-
-	rootJSONFile := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "metadata", "root.json")
-	rootFileBytes, err := ioutil.ReadFile(rootJSONFile)
-
-	signedTargets, err := savedTUFRepo.SignTargets("targets", data.DefaultExpires("targets"))
-	assert.NoError(t, err)
-
-	signedSnapshot, err := savedTUFRepo.SignSnapshot(data.DefaultExpires("snapshot"))
-	assert.NoError(t, err)
-
-	signedTimestamp, err := savedTUFRepo.SignTimestamp(data.DefaultExpires("timestamp"))
-	assert.NoError(t, err)
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/root.json", func(w http.ResponseWriter, r *http.Request) {
-		assert.NoError(t, err)
-		fmt.Fprint(w, string(rootFileBytes))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.json", func(w http.ResponseWriter, r *http.Request) {
-		timestampJSON, _ := json.Marshal(signedTimestamp)
-		fmt.Fprint(w, string(timestampJSON))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/snapshot.json", func(w http.ResponseWriter, r *http.Request) {
-		snapshotJSON, _ := json.Marshal(signedSnapshot)
-		fmt.Fprint(w, string(snapshotJSON))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/targets.json", func(w http.ResponseWriter, r *http.Request) {
-		targetsJSON, _ := json.Marshal(signedTargets)
-		fmt.Fprint(w, string(targetsJSON))
-	})
-
-	_, err = repo.ListTargets()
-	assert.NoError(t, err)
+	fakeServerData(t, repo, mux)
 
 	//
 	// Test TOFUS logic. We remove all certs and expect a new one to be added after ListTargets
@@ -126,13 +72,16 @@ func validateRootSuccessfully(t *testing.T, rootType string) {
 	assert.Len(t, repo.KeyStoreManager.TrustedCertificateStore().GetCertificates(), 0)
 
 	// Add a previously generated certificate with CN=docker.com/notary
-	err = repo.KeyStoreManager.TrustedCertificateStore().AddCertFromFile("../fixtures/self-signed_docker.com-notary.crt")
+	err = repo.KeyStoreManager.TrustedCertificateStore().AddCertFromFile(
+		"../fixtures/self-signed_docker.com-notary.crt")
 	assert.NoError(t, err)
 
 	// This list targets is expected to fail, since there already exists a certificate
 	// in the store for the dnsName docker.com/notary, so TOFUS doesn't apply
 	_, err = repo.ListTargets()
 	if assert.Error(t, err, "An error was expected") {
-		assert.Equal(t, err, &keystoremanager.ErrValidationFail{Reason: "failed to validate data with current trusted certificates"})
+		assert.Equal(t, err, &keystoremanager.ErrValidationFail{
+			Reason: "failed to validate data with current trusted certificates",
+		})
 	}
 }
diff --git a/client/client_test.go b/client/client_test.go
index eb2864ff52..156d640ccf 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -1,6 +1,7 @@
 package client
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -11,15 +12,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/distribution/registry/api/v2"
+	"github.com/Sirupsen/logrus"
+	ctxu "github.com/docker/distribution/context"
 	"github.com/docker/notary/client/changelist"
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/server/handlers"
+	"github.com/docker/notary/server"
 	"github.com/docker/notary/server/storage"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/utils"
-	"github.com/gorilla/mux"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
@@ -28,7 +28,7 @@ const timestampKeyJSON = `{"keytype":"rsa","keyval":{"public":"MIIBIjANBgkqhkiG9
 const timestampECDSAKeyJSON = `
 {"keytype":"ecdsa","keyval":{"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw==","private":"MHcCAQEEIDqtcdzU7H3AbIPSQaxHl9+xYECt7NpK7B1+6ep5cv9CoAoGCCqGSM49AwEHoUQDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}`
 
-func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
+func simpleTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
 	mux := http.NewServeMux()
 	// TUF will request /v2/docker.com/notary/_trust/tuf/timestamp.key
 	// Return a canned timestamp.key
@@ -43,6 +43,41 @@ func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
 	return ts, mux
 }
 
+func fullTestServer(t *testing.T) *httptest.Server {
+	// Set up server
+	ctx := context.WithValue(
+		context.Background(), "metaStore", storage.NewMemStorage())
+
+	// Do not pass one of the const KeyAlgorithms here as the value! Passing a
+	// string is in itself good test that we are handling it correctly as we
+	// will be receiving a string from the configuration.
+	ctx = context.WithValue(ctx, "keyAlgorithm", "ecdsa")
+
+	// Eat the logs instead of spewing them out
+	var b bytes.Buffer
+	l := logrus.New()
+	l.Out = &b
+	ctx = ctxu.WithLogger(ctx, logrus.NewEntry(l))
+
+	cryptoService := cryptoservice.NewCryptoService(
+		"", trustmanager.NewKeyMemoryStore(passphraseRetriever))
+	return httptest.NewServer(server.RootHandler(nil, ctx, cryptoService))
+}
+
+func initializeRepo(t *testing.T, rootType, tempBaseDir, gun, url string) (*NotaryRepository, string) {
+	repo, err := NewNotaryRepository(
+		tempBaseDir, gun, url, http.DefaultTransport, passphraseRetriever)
+	assert.NoError(t, err, "error creating repo: %s", err)
+
+	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
+	assert.NoError(t, err, "error generating root key: %s", err)
+
+	err = repo.Initialize(rootKeyID)
+	assert.NoError(t, err, "error creating repository: %s", err)
+
+	return repo, rootKeyID
+}
+
 // TestInitRepo runs through the process of initializing a repository and makes
 // sure the repository looks correct on disk.
 // We test this with both an RSA and ECDSA root key
@@ -61,17 +96,10 @@ func testInitRepo(t *testing.T, rootType string) {
 
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	ts, _ := createTestServer(t)
+	ts, _ := simpleTestServer(t)
 	defer ts.Close()
 
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
+	repo, rootKeyID := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
 	// Inspect contents of the temporary directory
 	expectedDirs := []string{
@@ -165,19 +193,32 @@ func testInitRepo(t *testing.T, rootType string) {
 	}
 }
 
-// TestAddListTarget adds a target to the repo and confirms that the changelist
-// is updated correctly. Then it calls ListTargets and checks the return value.
-// Using ListTargets involves serving signed metadata files over the test's
-// internal HTTP server.
+// TestAddTarget adds a target to the repo and confirms that the changelist
+// is updated correctly.
 // We test this with both an RSA and ECDSA root key
-func TestAddListTarget(t *testing.T) {
-	testAddListTarget(t, data.ECDSAKey)
+func TestAddTarget(t *testing.T) {
+	testAddTarget(t, data.ECDSAKey)
 	if !testing.Short() {
-		testAddListTarget(t, data.RSAKey)
+		testAddTarget(t, data.RSAKey)
 	}
 }
 
-func testAddListTarget(t *testing.T, rootType string) {
+func addTarget(t *testing.T, repo *NotaryRepository, targetName, targetFile string) *Target {
+	target, err := NewTarget(targetName, targetFile)
+	assert.NoError(t, err, "error creating target")
+	err = repo.AddTarget(target)
+	assert.NoError(t, err, "error adding target")
+	return target
+}
+
+// calls GetChangelist and gets the actual changes out
+func getChanges(t *testing.T, repo *NotaryRepository) []changelist.Change {
+	changeList, err := repo.GetChangelist()
+	assert.NoError(t, err)
+	return changeList.List()
+}
+
+func testAddTarget(t *testing.T, rootType string) {
 	// Temporary directory where test files will be created
 	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
 	defer os.RemoveAll(tempBaseDir)
@@ -186,151 +227,172 @@ func testAddListTarget(t *testing.T, rootType string) {
 
 	gun := "docker.com/notary"
 
-	ts, mux := createTestServer(t)
+	ts, _ := simpleTestServer(t)
 	defer ts.Close()
 
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repository: %s", err)
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
+	// tests need to manually boostrap timestamp as client doesn't generate it
+	err = repo.tufRepo.InitTimestamp()
 	assert.NoError(t, err, "error creating repository: %s", err)
+	assert.Len(t, getChanges(t, repo), 0, "should start with zero changes")
+
+	// Add fixtures/intermediate-ca.crt as a target. There's no particular
+	// reason for using this file except that it happens to be available as
+	// a fixture.
+	addTarget(t, repo, "latest", "../fixtures/intermediate-ca.crt")
+	changes := getChanges(t, repo)
+	assert.Len(t, changes, 1, "wrong number of changes files found")
+
+	for _, c := range changes { // there is only one
+		assert.EqualValues(t, changelist.ActionCreate, c.Action())
+		assert.Equal(t, "targets", c.Scope())
+		assert.Equal(t, "target", c.Type())
+		assert.Equal(t, "latest", c.Path())
+		assert.NotEmpty(t, c.Content())
+	}
+
+	// Create a second target
+	addTarget(t, repo, "current", "../fixtures/intermediate-ca.crt")
+	changes = getChanges(t, repo)
+	assert.Len(t, changes, 2, "wrong number of changelist files found")
+
+	newFileFound := false
+	for _, c := range changes {
+		if c.Path() != "latest" {
+			assert.EqualValues(t, changelist.ActionCreate, c.Action())
+			assert.Equal(t, "targets", c.Scope())
+			assert.Equal(t, "target", c.Type())
+			assert.Equal(t, "current", c.Path())
+			assert.NotEmpty(t, c.Content())
+
+			newFileFound = true
+		}
+	}
+	assert.True(t, newFileFound, "second changelist file not found")
+}
+
+// TestListTarget fakes serving signed metadata files over the test's
+// internal HTTP server to ensure that ListTargets returns the correct number
+// of listed targets.
+// We test this with both an RSA and ECDSA root key
+func TestListTarget(t *testing.T) {
+	testListEmptyTargets(t, data.ECDSAKey)
+	testListTarget(t, data.ECDSAKey)
+	if !testing.Short() {
+		testListEmptyTargets(t, data.RSAKey)
+		testListTarget(t, data.RSAKey)
+	}
+}
+
+func testListEmptyTargets(t *testing.T, rootType string) {
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	gun := "docker.com/notary"
+
+	ts := fullTestServer(t)
+	defer ts.Close()
+
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
 	// tests need to manually boostrap timestamp as client doesn't generate it
 	err = repo.tufRepo.InitTimestamp()
 	assert.NoError(t, err, "error creating repository: %s", err)
 
-	// Add fixtures/intermediate-ca.crt as a target. There's no particular reason
-	// for using this file except that it happens to be available as
-	// a fixture.
-	latestTarget, err := NewTarget("latest", "../fixtures/intermediate-ca.crt")
-	assert.NoError(t, err, "error creating target")
-	err = repo.AddTarget(latestTarget)
-	assert.NoError(t, err, "error adding target")
+	_, err = repo.ListTargets()
+	assert.Error(t, err) // no trust data
+}
 
-	// Look for the changelist file
-	changelistDirPath := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "changelist")
+// reads data from the repository in order to fake data being served via
+// the ServeMux.
+func fakeServerData(t *testing.T, repo *NotaryRepository, mux *http.ServeMux) {
+	tempKey, err := data.UnmarshalPrivateKey([]byte(timestampECDSAKeyJSON))
+	assert.NoError(t, err)
 
-	changelistDir, err := os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
+	savedTUFRepo := repo.tufRepo // in case this is overwritten
 
-	fileInfos, err := changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
+	repo.KeyStoreManager.KeyStore.AddKey(
+		filepath.Join(filepath.FromSlash(repo.gun), tempKey.ID()),
+		"nonroot", tempKey)
 
-	// Should only be one file in the directory
-	assert.Len(t, fileInfos, 1, "wrong number of changelist files found")
+	rootJSONFile := filepath.Join(repo.baseDir, "tuf",
+		filepath.FromSlash(repo.gun), "metadata", "root.json")
+	rootFileBytes, err := ioutil.ReadFile(rootJSONFile)
 
-	clName := fileInfos[0].Name()
-	raw, err := ioutil.ReadFile(filepath.Join(changelistDirPath, clName))
-	assert.NoError(t, err, "could not read changelist file %s", clName)
+	signedTargets, err := savedTUFRepo.SignTargets(
+		"targets", data.DefaultExpires("targets"))
+	assert.NoError(t, err)
 
-	c := &changelist.TufChange{}
-	err = json.Unmarshal(raw, c)
-	assert.NoError(t, err, "could not unmarshal changelist file %s", clName)
+	signedSnapshot, err := savedTUFRepo.SignSnapshot(
+		data.DefaultExpires("snapshot"))
+	assert.NoError(t, err)
 
-	assert.EqualValues(t, changelist.ActionCreate, c.Actn)
-	assert.Equal(t, "targets", c.Role)
-	assert.Equal(t, "target", c.ChangeType)
-	assert.Equal(t, "latest", c.ChangePath)
-	assert.NotEmpty(t, c.Data)
+	signedTimestamp, err := savedTUFRepo.SignTimestamp(
+		data.DefaultExpires("timestamp"))
+	assert.NoError(t, err)
 
-	changelistDir.Close()
+	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/root.json",
+		func(w http.ResponseWriter, r *http.Request) {
+			assert.NoError(t, err)
+			fmt.Fprint(w, string(rootFileBytes))
+		})
 
-	// Create a second target
-	currentTarget, err := NewTarget("current", "../fixtures/intermediate-ca.crt")
-	assert.NoError(t, err, "error creating target")
-	err = repo.AddTarget(currentTarget)
-	assert.NoError(t, err, "error adding target")
+	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.json",
+		func(w http.ResponseWriter, r *http.Request) {
+			timestampJSON, _ := json.Marshal(signedTimestamp)
+			fmt.Fprint(w, string(timestampJSON))
+		})
 
-	changelistDir, err = os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
+	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/snapshot.json",
+		func(w http.ResponseWriter, r *http.Request) {
+			snapshotJSON, _ := json.Marshal(signedSnapshot)
+			fmt.Fprint(w, string(snapshotJSON))
+		})
 
-	// There should now be a second file in the directory
-	fileInfos, err = changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
+	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/targets.json",
+		func(w http.ResponseWriter, r *http.Request) {
+			targetsJSON, _ := json.Marshal(signedTargets)
+			fmt.Fprint(w, string(targetsJSON))
+		})
+}
 
-	assert.Len(t, fileInfos, 2, "wrong number of changelist files found")
+func testListTarget(t *testing.T, rootType string) {
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
 
-	newFileFound := false
-	for _, fileInfo := range fileInfos {
-		if fileInfo.Name() != clName {
-			clName2 := fileInfo.Name()
-			raw, err := ioutil.ReadFile(filepath.Join(changelistDirPath, clName2))
-			assert.NoError(t, err, "could not read changelist file %s", clName2)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-			c := &changelist.TufChange{}
-			err = json.Unmarshal(raw, c)
-			assert.NoError(t, err, "could not unmarshal changelist file %s", clName2)
+	gun := "docker.com/notary"
 
-			assert.EqualValues(t, changelist.ActionCreate, c.Actn)
-			assert.Equal(t, "targets", c.Role)
-			assert.Equal(t, "target", c.ChangeType)
-			assert.Equal(t, "current", c.ChangePath)
-			assert.NotEmpty(t, c.Data)
+	ts, mux := simpleTestServer(t)
+	defer ts.Close()
 
-			newFileFound = true
-			break
-		}
-	}
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
-	assert.True(t, newFileFound, "second changelist file not found")
+	// tests need to manually boostrap timestamp as client doesn't generate it
+	err = repo.tufRepo.InitTimestamp()
+	assert.NoError(t, err, "error creating repository: %s", err)
 
-	changelistDir.Close()
-
-	// Now test ListTargets. In preparation, we need to expose some signed
-	// metadata files on the internal HTTP server.
+	latestTarget := addTarget(t, repo, "latest", "../fixtures/intermediate-ca.crt")
+	currentTarget := addTarget(t, repo, "current", "../fixtures/intermediate-ca.crt")
 
 	// Apply the changelist. Normally, this would be done by Publish
 
 	// load the changelist for this repo
-	cl, err := changelist.NewFileChangelist(filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "changelist"))
+	cl, err := changelist.NewFileChangelist(
+		filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "changelist"))
 	assert.NoError(t, err, "could not open changelist")
 
 	// apply the changelist to the repo
 	err = applyChangelist(repo.tufRepo, cl)
 	assert.NoError(t, err, "could not apply changelist")
 
-	tempKey, err := data.UnmarshalPrivateKey([]byte(timestampECDSAKeyJSON))
-	assert.NoError(t, err)
-
-	repo.KeyStoreManager.KeyStore.AddKey(filepath.Join(filepath.FromSlash(gun), tempKey.ID()), "nonroot", tempKey)
-
-	// Because ListTargets will clear this
-	savedTUFRepo := repo.tufRepo
-
-	rootJSONFile := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "metadata", "root.json")
-	rootFileBytes, err := ioutil.ReadFile(rootJSONFile)
-
-	signedTargets, err := savedTUFRepo.SignTargets("targets", data.DefaultExpires("targets"))
-	assert.NoError(t, err)
-
-	signedSnapshot, err := savedTUFRepo.SignSnapshot(data.DefaultExpires("snapshot"))
-	assert.NoError(t, err)
-
-	signedTimestamp, err := savedTUFRepo.SignTimestamp(data.DefaultExpires("timestamp"))
-	assert.NoError(t, err)
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/root.json", func(w http.ResponseWriter, r *http.Request) {
-		assert.NoError(t, err)
-		fmt.Fprint(w, string(rootFileBytes))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.json", func(w http.ResponseWriter, r *http.Request) {
-		timestampJSON, _ := json.Marshal(signedTimestamp)
-		fmt.Fprint(w, string(timestampJSON))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/snapshot.json", func(w http.ResponseWriter, r *http.Request) {
-		snapshotJSON, _ := json.Marshal(signedSnapshot)
-		fmt.Fprint(w, string(snapshotJSON))
-	})
-
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/targets.json", func(w http.ResponseWriter, r *http.Request) {
-		targetsJSON, _ := json.Marshal(signedTargets)
-		fmt.Fprint(w, string(targetsJSON))
-	})
+	fakeServerData(t, repo, mux)
 
 	targets, err := repo.ListTargets()
 	assert.NoError(t, err)
@@ -376,17 +438,10 @@ func testValidateRootKey(t *testing.T, rootType string) {
 
 	gun := "docker.com/notary"
 
-	ts, _ := createTestServer(t)
+	ts, _ := simpleTestServer(t)
 	defer ts.Close()
 
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
+	initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
 	rootJSONFile := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "metadata", "root.json")
 
@@ -419,6 +474,57 @@ func testValidateRootKey(t *testing.T, rootType string) {
 	}
 }
 
+// TestGetChangelist ensures that the changelist returned matches the changes
+// added.
+// We test this with both an RSA and ECDSA root key
+func TestGetChangelist(t *testing.T) {
+	testGetChangelist(t, data.ECDSAKey)
+	if !testing.Short() {
+		testGetChangelist(t, data.RSAKey)
+	}
+}
+
+func testGetChangelist(t *testing.T, rootType string) {
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	gun := "docker.com/notary"
+	ts, _ := simpleTestServer(t)
+
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
+	assert.Len(t, getChanges(t, repo), 0, "No changes should be in changelist yet")
+
+	// Create 2 targets
+	addTarget(t, repo, "latest", "../fixtures/intermediate-ca.crt")
+	addTarget(t, repo, "current", "../fixtures/intermediate-ca.crt")
+
+	// Test loading changelist
+	chgs := getChanges(t, repo)
+	assert.Len(t, chgs, 2, "Wrong number of changes returned from changelist")
+
+	changes := make(map[string]changelist.Change)
+	for _, ch := range chgs {
+		changes[ch.Path()] = ch
+	}
+
+	currentChange := changes["current"]
+	assert.NotNil(t, currentChange, "Expected changelist to contain a change for path 'current'")
+	assert.EqualValues(t, changelist.ActionCreate, currentChange.Action())
+	assert.Equal(t, "targets", currentChange.Scope())
+	assert.Equal(t, "target", currentChange.Type())
+	assert.Equal(t, "current", currentChange.Path())
+
+	latestChange := changes["latest"]
+	assert.NotNil(t, latestChange, "Expected changelist to contain a change for path 'latest'")
+	assert.EqualValues(t, changelist.ActionCreate, latestChange.Action())
+	assert.Equal(t, "targets", latestChange.Scope())
+	assert.Equal(t, "target", latestChange.Type())
+	assert.Equal(t, "latest", latestChange.Path())
+}
+
 // TestPublish creates a repo, instantiates a notary server, and publishes
 // the repo to the server.
 // We test this with both an RSA and ECDSA root key
@@ -437,148 +543,19 @@ func testPublish(t *testing.T, rootType string) {
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
 	gun := "docker.com/notary"
+	ts := fullTestServer(t)
 
-	// Set up server
-	ctx := context.WithValue(context.Background(), "metaStore", storage.NewMemStorage())
+	repo, _ := initializeRepo(t, rootType, tempBaseDir, gun, ts.URL)
 
-	// Do not pass one of the const KeyAlgorithms here as the value! Passing a
-	// string is in itself good test that we are handling it correctly as we will
-	// be receiving a string from the configuration.
-	ctx = context.WithValue(ctx, "keyAlgorithm", "ecdsa")
-
-	hand := utils.RootHandlerFactory(nil, ctx,
-		cryptoservice.NewCryptoService("", trustmanager.NewKeyMemoryStore(passphraseRetriever)))
-
-	r := mux.NewRouter()
-	r.Methods("POST").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/").Handler(hand(handlers.AtomicUpdateHandler, "push", "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/{tufRole:(root|targets|snapshot)}.json").Handler(hand(handlers.GetHandler, "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/timestamp.json").Handler(hand(handlers.GetTimestampHandler, "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/timestamp.key").Handler(hand(handlers.GetTimestampKeyHandler, "push", "pull"))
-	//r.Methods("POST").Path("/v2/{imageName:" + server.RepositoryNameRegexp + "}/_trust/tuf/{tufRole:(root|targets|timestamp|snapshot)}.json").Handler(hand(handlers.UpdateHandler, "push", "pull"))
-	r.Methods("DELETE").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/").Handler(hand(handlers.DeleteHandler, "push", "pull"))
-
-	ts := httptest.NewServer(r)
-
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(rootType)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	// Add fixtures/intermediate-ca.crt as a target. There's no particular reason
-	// for using this file except that it happens to be available as
-	// a fixture.
-	latestTarget, err := NewTarget("latest", "../fixtures/intermediate-ca.crt")
-	assert.NoError(t, err, "error creating target")
-	err = repo.AddTarget(latestTarget)
-	assert.NoError(t, err, "error adding target")
-
-	// Look for the changelist file
-	changelistDirPath := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "changelist")
-
-	changelistDir, err := os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
-
-	fileInfos, err := changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
-
-	// Should only be one file in the directory
-	assert.Len(t, fileInfos, 1, "wrong number of changelist files found")
-
-	clName := fileInfos[0].Name()
-	raw, err := ioutil.ReadFile(filepath.Join(changelistDirPath, clName))
-	assert.NoError(t, err, "could not read changelist file %s", clName)
-
-	c := &changelist.TufChange{}
-	err = json.Unmarshal(raw, c)
-	assert.NoError(t, err, "could not unmarshal changelist file %s", clName)
-
-	assert.EqualValues(t, changelist.ActionCreate, c.Actn)
-	assert.Equal(t, "targets", c.Role)
-	assert.Equal(t, "target", c.ChangeType)
-	assert.Equal(t, "latest", c.ChangePath)
-	assert.NotEmpty(t, c.Data)
-
-	changelistDir.Close()
-
-	// Create a second target
-	currentTarget, err := NewTarget("current", "../fixtures/intermediate-ca.crt")
-	assert.NoError(t, err, "error creating target")
-	err = repo.AddTarget(currentTarget)
-	assert.NoError(t, err, "error adding target")
-
-	changelistDir, err = os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
-
-	// There should now be a second file in the directory
-	fileInfos, err = changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
-
-	assert.Len(t, fileInfos, 2, "wrong number of changelist files found")
-
-	newFileFound := false
-	for _, fileInfo := range fileInfos {
-		if fileInfo.Name() != clName {
-			clName2 := fileInfo.Name()
-			raw, err := ioutil.ReadFile(filepath.Join(changelistDirPath, clName2))
-			assert.NoError(t, err, "could not read changelist file %s", clName2)
-
-			c := &changelist.TufChange{}
-			err = json.Unmarshal(raw, c)
-			assert.NoError(t, err, "could not unmarshal changelist file %s", clName2)
-
-			assert.EqualValues(t, changelist.ActionCreate, c.Actn)
-			assert.Equal(t, "targets", c.Role)
-			assert.Equal(t, "target", c.ChangeType)
-			assert.Equal(t, "current", c.ChangePath)
-			assert.NotEmpty(t, c.Data)
-
-			newFileFound = true
-			break
-		}
-	}
-
-	assert.True(t, newFileFound, "second changelist file not found")
-
-	changelistDir.Close()
-
-	// Test loading changelist
-	changes := make(map[string]changelist.Change)
-	cl, err := repo.GetChangelist()
-	assert.NoError(t, err, "could not get changelist for repo")
-
-	assert.Len(t, cl.List(), 2, "Wrong number of changes returned from changelist")
-	for _, ch := range cl.List() {
-		changes[ch.Path()] = ch
-	}
-
-	currentChange := changes["current"]
-	assert.NotNil(t, currentChange, "Expected changelist to contain a change for path 'current'")
-	assert.EqualValues(t, changelist.ActionCreate, currentChange.Action())
-	assert.Equal(t, "targets", currentChange.Scope())
-	assert.Equal(t, "target", currentChange.Type())
-	assert.Equal(t, "current", currentChange.Path())
-
-	latestChange := changes["latest"]
-	assert.NotNil(t, latestChange, "Expected changelist to contain a change for path 'latest'")
-	assert.EqualValues(t, changelist.ActionCreate, latestChange.Action())
-	assert.Equal(t, "targets", latestChange.Scope())
-	assert.Equal(t, "target", latestChange.Type())
-	assert.Equal(t, "latest", latestChange.Path())
+	// Create 2 targets
+	latestTarget := addTarget(t, repo, "latest", "../fixtures/intermediate-ca.crt")
+	currentTarget := addTarget(t, repo, "current", "../fixtures/intermediate-ca.crt")
+	assert.Len(t, getChanges(t, repo), 2, "wrong number of changelist files found")
 
 	// Now test Publish
 	err = repo.Publish()
 	assert.NoError(t, err)
-
-	changelistDir, err = os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
-	fileInfos, err = changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
-	// Should only be one file in the directory
-	assert.Len(t, fileInfos, 0, "wrong number of changelist files found")
+	assert.Len(t, getChanges(t, repo), 0, "wrong number of changelist files found")
 
 	// Create a new repo and pull from the server
 	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
@@ -624,45 +601,13 @@ func TestRotate(t *testing.T) {
 
 	gun := "docker.com/notary"
 
-	// Set up server
-	ctx := context.WithValue(context.Background(), "metaStore", storage.NewMemStorage())
+	ts := fullTestServer(t)
 
-	// Do not pass one of the const KeyAlgorithms here as the value! Passing a
-	// string is in itself good test that we are handling it correctly as we will
-	// be receiving a string from the configuration.
-	ctx = context.WithValue(ctx, "keyAlgorithm", "ecdsa")
+	repo, _ := initializeRepo(t, data.ECDSAKey, tempBaseDir, gun, ts.URL)
 
-	hand := utils.RootHandlerFactory(nil, ctx,
-		cryptoservice.NewCryptoService("", trustmanager.NewKeyMemoryStore(passphraseRetriever)))
-
-	r := mux.NewRouter()
-	r.Methods("POST").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/").Handler(hand(handlers.AtomicUpdateHandler, "push", "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/{tufRole:(root|targets|snapshot)}.json").Handler(hand(handlers.GetHandler, "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/timestamp.json").Handler(hand(handlers.GetTimestampHandler, "pull"))
-	r.Methods("GET").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/timestamp.key").Handler(hand(handlers.GetTimestampKeyHandler, "push", "pull"))
-	//r.Methods("POST").Path("/v2/{imageName:" + server.RepositoryNameRegexp + "}/_trust/tuf/{tufRole:(root|targets|timestamp|snapshot)}.json").Handler(hand(handlers.UpdateHandler, "push", "pull"))
-	r.Methods("DELETE").Path("/v2/{imageName:" + v2.RepositoryNameRegexp.String() + "}/_trust/tuf/").Handler(hand(handlers.DeleteHandler, "push", "pull"))
-
-	ts := httptest.NewServer(r)
-
-	repo, err := NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, passphraseRetriever)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	// Add fixtures/intermediate-ca.crt as a target. There's no particular reason
-	// for using this file except that it happens to be available as
-	// a fixture.
 	// Adding a target will allow us to confirm the repository is still valid after
 	// rotating the keys.
-	latestTarget, err := NewTarget("latest", "../fixtures/intermediate-ca.crt")
-	assert.NoError(t, err, "error creating target")
-	err = repo.AddTarget(latestTarget)
-	assert.NoError(t, err, "error adding target")
+	addTarget(t, repo, "latest", "../fixtures/intermediate-ca.crt")
 
 	// Publish
 	err = repo.Publish()
@@ -694,12 +639,6 @@ func TestRotate(t *testing.T) {
 	assert.NotEqual(t, snapshotKeyIDs[0], newSnapshotKeyIDs[0])
 
 	// Confirm changelist dir empty after publishing changes
-	// Look for the changelist file
-	changelistDirPath := filepath.Join(tempBaseDir, "tuf", filepath.FromSlash(gun), "changelist")
-	changelistDir, err := os.Open(changelistDirPath)
-	assert.NoError(t, err, "could not open changelist directory")
-	fileInfos, err := changelistDir.Readdir(0)
-	assert.NoError(t, err, "could not read changelist directory")
-	// Should only be one file in the directory
-	assert.Len(t, fileInfos, 0, "wrong number of changelist files found")
+	changes := getChanges(t, repo)
+	assert.Len(t, changes, 0, "wrong number of changelist files found")
 }

From 24cca5d6ccebde4e6633d18aea5e54f30e741c99 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 4 Nov 2015 16:43:51 -0800
Subject: [PATCH 17/85] Update the cobra dependency and its subdependencies
 (pflag, blackfriday, sanitized_anchor_name, and go-md2man).

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 Godeps/Godeps.json                            |   18 +-
 .../cpuguy83/go-md2man/md2man/md2man.go       |   19 +
 .../cpuguy83/go-md2man/md2man/roff.go         |  269 ++++
 .../russross/blackfriday/.gitignore           |    8 +
 .../russross/blackfriday/.travis.yml          |   17 +
 .../russross/blackfriday/LICENSE.txt          |   29 +
 .../github.com/russross/blackfriday/README.md |  246 +++
 .../github.com/russross/blackfriday/block.go  | 1389 +++++++++++++++++
 .../github.com/russross/blackfriday/html.go   |  948 +++++++++++
 .../github.com/russross/blackfriday/inline.go | 1103 +++++++++++++
 .../github.com/russross/blackfriday/latex.go  |  332 ++++
 .../russross/blackfriday/markdown.go          |  919 +++++++++++
 .../russross/blackfriday/smartypants.go       |  398 +++++
 .../sanitized_anchor_name/.travis.yml         |   10 +
 .../shurcooL/sanitized_anchor_name/README.md  |   31 +
 .../shurcooL/sanitized_anchor_name/main.go    |   29 +
 .../src/github.com/spf13/cobra/.travis.yml    |    3 +-
 .../src/github.com/spf13/cobra/README.md      |   92 +-
 .../spf13/cobra/bash_completions.go           |   95 +-
 .../spf13/cobra/bash_completions_test.go      |   82 -
 .../src/github.com/spf13/cobra/cobra.go       |   70 +-
 .../github.com/spf13/cobra/cobra/cmd/add.go   |  125 ++
 .../spf13/cobra/cobra/cmd/helpers.go          |  342 ++++
 .../github.com/spf13/cobra/cobra/cmd/init.go  |  219 +++
 .../spf13/cobra/cobra/cmd/licenses.go         |  435 ++++++
 .../github.com/spf13/cobra/cobra/cmd/root.go  |   84 +
 .../src/github.com/spf13/cobra/cobra/main.go  |   20 +
 .../src/github.com/spf13/cobra/cobra_test.go  |  942 -----------
 .../src/github.com/spf13/cobra/command.go     |  409 +++--
 .../github.com/spf13/cobra/command_test.go    |   90 --
 .../src/github.com/spf13/cobra/doc_util.go    |   34 +
 .../src/github.com/spf13/cobra/man_docs.go    |  213 +++
 .../src/github.com/spf13/cobra/man_docs.md    |   25 +
 .../src/github.com/spf13/cobra/md_docs.go     |   33 +-
 .../github.com/spf13/cobra/md_docs_test.go    |   67 -
 .../src/github.com/spf13/pflag/.travis.yml    |   10 +
 .../src/github.com/spf13/pflag/README.md      |   87 +-
 .../src/github.com/spf13/pflag/bool.go        |   40 +-
 .../src/github.com/spf13/pflag/bool_test.go   |  164 --
 .../src/github.com/spf13/pflag/count.go       |   97 ++
 .../src/github.com/spf13/pflag/duration.go    |   25 +-
 .../github.com/spf13/pflag/example_test.go    |   77 -
 .../src/github.com/spf13/pflag/export_test.go |   29 -
 .../src/github.com/spf13/pflag/flag.go        |  385 +++--
 .../src/github.com/spf13/pflag/flag_test.go   |  658 --------
 .../src/github.com/spf13/pflag/float32.go     |   25 +-
 .../src/github.com/spf13/pflag/float64.go     |   21 +-
 .../src/github.com/spf13/pflag/golangflag.go  |   97 ++
 .../src/github.com/spf13/pflag/int.go         |   21 +-
 .../src/github.com/spf13/pflag/int32.go       |   25 +-
 .../src/github.com/spf13/pflag/int64.go       |   21 +-
 .../src/github.com/spf13/pflag/int8.go        |   25 +-
 .../src/github.com/spf13/pflag/int_slice.go   |  128 ++
 .../src/github.com/spf13/pflag/ip.go          |   30 +-
 .../src/github.com/spf13/pflag/ipmask.go      |   48 +-
 .../src/github.com/spf13/pflag/ipnet.go       |  100 ++
 .../src/github.com/spf13/pflag/string.go      |   21 +-
 .../github.com/spf13/pflag/string_slice.go    |  111 ++
 .../src/github.com/spf13/pflag/uint.go        |   25 +-
 .../src/github.com/spf13/pflag/uint16.go      |   25 +-
 .../src/github.com/spf13/pflag/uint32.go      |   25 +-
 .../src/github.com/spf13/pflag/uint64.go      |   25 +-
 .../src/github.com/spf13/pflag/uint8.go       |   25 +-
 .../src/github.com/spf13/pflag/verify/all.sh  |   69 +
 .../github.com/spf13/pflag/verify/gofmt.sh    |   19 +
 .../github.com/spf13/pflag/verify/golint.sh   |   15 +
 66 files changed, 9119 insertions(+), 2499 deletions(-)
 create mode 100644 Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/md2man.go
 create mode 100644 Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/roff.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/.gitignore
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/.travis.yml
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/LICENSE.txt
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/README.md
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/block.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/html.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/inline.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/latex.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/markdown.go
 create mode 100644 Godeps/_workspace/src/github.com/russross/blackfriday/smartypants.go
 create mode 100644 Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/.travis.yml
 create mode 100644 Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/README.md
 create mode 100644 Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/main.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/bash_completions_test.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/add.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/helpers.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/init.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/licenses.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/root.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra/main.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/cobra_test.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/command_test.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/doc_util.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/man_docs.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/man_docs.md
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/cobra/md_docs_test.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/bool_test.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/count.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/example_test.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/export_test.go
 delete mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/flag_test.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/golangflag.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/int_slice.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/ipnet.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/string_slice.go
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/verify/all.sh
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/verify/gofmt.sh
 create mode 100644 Godeps/_workspace/src/github.com/spf13/pflag/verify/golint.sh

diff --git a/Godeps/Godeps.json b/Godeps/Godeps.json
index 010cab1c36..a51051fa94 100644
--- a/Godeps/Godeps.json
+++ b/Godeps/Godeps.json
@@ -35,6 +35,11 @@
 			"ImportPath": "github.com/bugsnag/panicwrap",
 			"Rev": "e5f9854865b9778a45169fc249e99e338d4d6f27"
 		},
+		{
+			"ImportPath": "github.com/cpuguy83/go-md2man/md2man",
+			"Comment": "v1.0.4",
+			"Rev": "71acacd42f85e5e82f70a55327789582a5200a90"
+		},
 		{
 			"ImportPath": "github.com/docker/distribution/context",
 			"Comment": "v2.0.0-353-gfed58bd",
@@ -197,13 +202,22 @@
 			"ImportPath": "github.com/prometheus/procfs",
 			"Rev": "b1afdc266f54247f5dc725544f5d351a8661f502"
 		},
+		{
+			"ImportPath": "github.com/russross/blackfriday",
+			"Comment": "v1.3",
+			"Rev": "8cec3a854e68dba10faabbe31c089abf4a3e57a6"
+		},
+		{
+			"ImportPath": "github.com/shurcooL/sanitized_anchor_name",
+			"Rev": "244f5ac324cb97e1987ef901a0081a77bfd8e845"
+		},
 		{
 			"ImportPath": "github.com/spf13/cast",
 			"Rev": "4d07383ffe94b5e5a6fa3af9211374a4507a0184"
 		},
 		{
 			"ImportPath": "github.com/spf13/cobra",
-			"Rev": "312092086bed4968099259622145a0c9ae280064"
+			"Rev": "2e6a42892123dda608922f8af8ce85c3bff19575"
 		},
 		{
 			"ImportPath": "github.com/spf13/jwalterweatherman",
@@ -211,7 +225,7 @@
 		},
 		{
 			"ImportPath": "github.com/spf13/pflag",
-			"Rev": "5644820622454e71517561946e3d94b9f9db6842"
+			"Rev": "08b1a584251b5b62f458943640fc8ebd4d50aaa5"
 		},
 		{
 			"ImportPath": "github.com/spf13/viper",
diff --git a/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/md2man.go b/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/md2man.go
new file mode 100644
index 0000000000..8f44fa1550
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/md2man.go
@@ -0,0 +1,19 @@
+package md2man
+
+import (
+	"github.com/russross/blackfriday"
+)
+
+func Render(doc []byte) []byte {
+	renderer := RoffRenderer(0)
+	extensions := 0
+	extensions |= blackfriday.EXTENSION_NO_INTRA_EMPHASIS
+	extensions |= blackfriday.EXTENSION_TABLES
+	extensions |= blackfriday.EXTENSION_FENCED_CODE
+	extensions |= blackfriday.EXTENSION_AUTOLINK
+	extensions |= blackfriday.EXTENSION_SPACE_HEADERS
+	extensions |= blackfriday.EXTENSION_FOOTNOTES
+	extensions |= blackfriday.EXTENSION_TITLEBLOCK
+
+	return blackfriday.Markdown(doc, renderer, extensions)
+}
diff --git a/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/roff.go b/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/roff.go
new file mode 100644
index 0000000000..4478786b7b
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/cpuguy83/go-md2man/md2man/roff.go
@@ -0,0 +1,269 @@
+package md2man
+
+import (
+	"bytes"
+	"fmt"
+	"html"
+	"strings"
+
+	"github.com/russross/blackfriday"
+)
+
+type roffRenderer struct{}
+
+func RoffRenderer(flags int) blackfriday.Renderer {
+	return &roffRenderer{}
+}
+
+func (r *roffRenderer) GetFlags() int {
+	return 0
+}
+
+func (r *roffRenderer) TitleBlock(out *bytes.Buffer, text []byte) {
+	out.WriteString(".TH ")
+
+	splitText := bytes.Split(text, []byte("\n"))
+	for i, line := range splitText {
+		line = bytes.TrimPrefix(line, []byte("% "))
+		if i == 0 {
+			line = bytes.Replace(line, []byte("("), []byte("\" \""), 1)
+			line = bytes.Replace(line, []byte(")"), []byte("\" \""), 1)
+		}
+		line = append([]byte("\""), line...)
+		line = append(line, []byte("\" ")...)
+		out.Write(line)
+	}
+
+	out.WriteString(" \"\"\n")
+}
+
+func (r *roffRenderer) BlockCode(out *bytes.Buffer, text []byte, lang string) {
+	out.WriteString("\n.PP\n.RS\n\n.nf\n")
+	escapeSpecialChars(out, text)
+	out.WriteString("\n.fi\n.RE\n")
+}
+
+func (r *roffRenderer) BlockQuote(out *bytes.Buffer, text []byte) {
+	out.WriteString("\n.PP\n.RS\n")
+	out.Write(text)
+	out.WriteString("\n.RE\n")
+}
+
+func (r *roffRenderer) BlockHtml(out *bytes.Buffer, text []byte) {
+	out.Write(text)
+}
+
+func (r *roffRenderer) Header(out *bytes.Buffer, text func() bool, level int, id string) {
+	marker := out.Len()
+
+	switch {
+	case marker == 0:
+		// This is the doc header
+		out.WriteString(".TH ")
+	case level == 1:
+		out.WriteString("\n\n.SH ")
+	case level == 2:
+		out.WriteString("\n.SH ")
+	default:
+		out.WriteString("\n.SS ")
+	}
+
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+}
+
+func (r *roffRenderer) HRule(out *bytes.Buffer) {
+	out.WriteString("\n.ti 0\n\\l'\\n(.lu'\n")
+}
+
+func (r *roffRenderer) List(out *bytes.Buffer, text func() bool, flags int) {
+	marker := out.Len()
+	out.WriteString(".IP ")
+	if flags&blackfriday.LIST_TYPE_ORDERED != 0 {
+		out.WriteString("\\(bu 2")
+	} else {
+		out.WriteString("\\n+[step" + string(flags) + "]")
+	}
+	out.WriteString("\n")
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+
+}
+
+func (r *roffRenderer) ListItem(out *bytes.Buffer, text []byte, flags int) {
+	out.WriteString("\n\\item ")
+	out.Write(text)
+}
+
+func (r *roffRenderer) Paragraph(out *bytes.Buffer, text func() bool) {
+	marker := out.Len()
+	out.WriteString("\n.PP\n")
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	if marker != 0 {
+		out.WriteString("\n")
+	}
+}
+
+// TODO: This might now work
+func (r *roffRenderer) Table(out *bytes.Buffer, header []byte, body []byte, columnData []int) {
+	out.WriteString(".TS\nallbox;\n")
+
+	out.Write(header)
+	out.Write(body)
+	out.WriteString("\n.TE\n")
+}
+
+func (r *roffRenderer) TableRow(out *bytes.Buffer, text []byte) {
+	if out.Len() > 0 {
+		out.WriteString("\n")
+	}
+	out.Write(text)
+	out.WriteString("\n")
+}
+
+func (r *roffRenderer) TableHeaderCell(out *bytes.Buffer, text []byte, align int) {
+	if out.Len() > 0 {
+		out.WriteString(" ")
+	}
+	out.Write(text)
+	out.WriteString(" ")
+}
+
+// TODO: This is probably broken
+func (r *roffRenderer) TableCell(out *bytes.Buffer, text []byte, align int) {
+	if out.Len() > 0 {
+		out.WriteString("\t")
+	}
+	out.Write(text)
+	out.WriteString("\t")
+}
+
+func (r *roffRenderer) Footnotes(out *bytes.Buffer, text func() bool) {
+
+}
+
+func (r *roffRenderer) FootnoteItem(out *bytes.Buffer, name, text []byte, flags int) {
+
+}
+
+func (r *roffRenderer) AutoLink(out *bytes.Buffer, link []byte, kind int) {
+	out.WriteString("\n\\[la]")
+	out.Write(link)
+	out.WriteString("\\[ra]")
+}
+
+func (r *roffRenderer) CodeSpan(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\fB\\fC")
+	escapeSpecialChars(out, text)
+	out.WriteString("\\fR")
+}
+
+func (r *roffRenderer) DoubleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\fB")
+	out.Write(text)
+	out.WriteString("\\fP")
+}
+
+func (r *roffRenderer) Emphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\fI")
+	out.Write(text)
+	out.WriteString("\\fP")
+}
+
+func (r *roffRenderer) Image(out *bytes.Buffer, link []byte, title []byte, alt []byte) {
+}
+
+func (r *roffRenderer) LineBreak(out *bytes.Buffer) {
+	out.WriteString("\n.br\n")
+}
+
+func (r *roffRenderer) Link(out *bytes.Buffer, link []byte, title []byte, content []byte) {
+	r.AutoLink(out, link, 0)
+}
+
+func (r *roffRenderer) RawHtmlTag(out *bytes.Buffer, tag []byte) {
+	out.Write(tag)
+}
+
+func (r *roffRenderer) TripleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\s+2")
+	out.Write(text)
+	out.WriteString("\\s-2")
+}
+
+func (r *roffRenderer) StrikeThrough(out *bytes.Buffer, text []byte) {
+}
+
+func (r *roffRenderer) FootnoteRef(out *bytes.Buffer, ref []byte, id int) {
+
+}
+
+func (r *roffRenderer) Entity(out *bytes.Buffer, entity []byte) {
+	out.WriteString(html.UnescapeString(string(entity)))
+}
+
+func processFooterText(text []byte) []byte {
+	text = bytes.TrimPrefix(text, []byte("% "))
+	newText := []byte{}
+	textArr := strings.Split(string(text), ") ")
+
+	for i, w := range textArr {
+		if i == 0 {
+			w = strings.Replace(w, "(", "\" \"", 1)
+			w = fmt.Sprintf("\"%s\"", w)
+		} else {
+			w = fmt.Sprintf(" \"%s\"", w)
+		}
+		newText = append(newText, []byte(w)...)
+	}
+	newText = append(newText, []byte(" \"\"")...)
+
+	return newText
+}
+
+func (r *roffRenderer) NormalText(out *bytes.Buffer, text []byte) {
+	escapeSpecialChars(out, text)
+}
+
+func (r *roffRenderer) DocumentHeader(out *bytes.Buffer) {
+}
+
+func (r *roffRenderer) DocumentFooter(out *bytes.Buffer) {
+}
+
+func needsBackslash(c byte) bool {
+	for _, r := range []byte("-_&\\~") {
+		if c == r {
+			return true
+		}
+	}
+	return false
+}
+
+func escapeSpecialChars(out *bytes.Buffer, text []byte) {
+	for i := 0; i < len(text); i++ {
+		// directly copy normal characters
+		org := i
+
+		for i < len(text) && !needsBackslash(text[i]) {
+			i++
+		}
+		if i > org {
+			out.Write(text[org:i])
+		}
+
+		// escape a character
+		if i >= len(text) {
+			break
+		}
+		out.WriteByte('\\')
+		out.WriteByte(text[i])
+	}
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/.gitignore b/Godeps/_workspace/src/github.com/russross/blackfriday/.gitignore
new file mode 100644
index 0000000000..75623dcccb
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/.gitignore
@@ -0,0 +1,8 @@
+*.out
+*.swp
+*.8
+*.6
+_obj
+_test*
+markdown
+tags
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/.travis.yml b/Godeps/_workspace/src/github.com/russross/blackfriday/.travis.yml
new file mode 100644
index 0000000000..4dd7a1c591
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/.travis.yml
@@ -0,0 +1,17 @@
+# Travis CI (http://travis-ci.org/) is a continuous integration service for
+# open source projects. This file configures it to run unit tests for
+# blackfriday.
+
+language: go
+
+go:
+    - 1.2
+    - 1.3
+    - 1.4
+
+install:
+    - go get -d -t -v ./...
+    - go build -v ./...
+
+script:
+    - go test -v ./...
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/LICENSE.txt b/Godeps/_workspace/src/github.com/russross/blackfriday/LICENSE.txt
new file mode 100644
index 0000000000..2885af3602
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/LICENSE.txt
@@ -0,0 +1,29 @@
+Blackfriday is distributed under the Simplified BSD License:
+
+> Copyright © 2011 Russ Ross
+> All rights reserved.
+>
+> Redistribution and use in source and binary forms, with or without
+> modification, are permitted provided that the following conditions
+> are met:
+>
+> 1.  Redistributions of source code must retain the above copyright
+>     notice, this list of conditions and the following disclaimer.
+>
+> 2.  Redistributions in binary form must reproduce the above
+>     copyright notice, this list of conditions and the following
+>     disclaimer in the documentation and/or other materials provided with
+>     the distribution.
+>
+> THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+> "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+> LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+> FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+> COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+> INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+> BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+> LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+> CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+> LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+> ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+> POSSIBILITY OF SUCH DAMAGE.
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/README.md b/Godeps/_workspace/src/github.com/russross/blackfriday/README.md
new file mode 100644
index 0000000000..52e3b25b10
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/README.md
@@ -0,0 +1,246 @@
+Blackfriday [![Build Status](https://travis-ci.org/russross/blackfriday.svg?branch=master)](https://travis-ci.org/russross/blackfriday)
+===========
+
+Blackfriday is a [Markdown][1] processor implemented in [Go][2]. It
+is paranoid about its input (so you can safely feed it user-supplied
+data), it is fast, it supports common extensions (tables, smart
+punctuation substitutions, etc.), and it is safe for all utf-8
+(unicode) input.
+
+HTML output is currently supported, along with Smartypants
+extensions. An experimental LaTeX output engine is also included.
+
+It started as a translation from C of [Sundown][3].
+
+
+Installation
+------------
+
+Blackfriday is compatible with Go 1. If you are using an older
+release of Go, consider using v1.1 of blackfriday, which was based
+on the last stable release of Go prior to Go 1. You can find it as a
+tagged commit on github.
+
+With Go 1 and git installed:
+
+    go get github.com/russross/blackfriday
+
+will download, compile, and install the package into your `$GOPATH`
+directory hierarchy. Alternatively, you can achieve the same if you
+import it into a project:
+
+    import "github.com/russross/blackfriday"
+
+and `go get` without parameters.
+
+Usage
+-----
+
+For basic usage, it is as simple as getting your input into a byte
+slice and calling:
+
+    output := blackfriday.MarkdownBasic(input)
+
+This renders it with no extensions enabled. To get a more useful
+feature set, use this instead:
+
+    output := blackfriday.MarkdownCommon(input)
+
+### Sanitize untrusted content
+
+Blackfriday itself does nothing to protect against malicious content. If you are
+dealing with user-supplied markdown, we recommend running blackfriday's output
+through HTML sanitizer such as
+[Bluemonday](https://github.com/microcosm-cc/bluemonday).
+
+Here's an example of simple usage of blackfriday together with bluemonday:
+
+``` go
+import (
+    "github.com/microcosm-cc/bluemonday"
+    "github.com/russross/blackfriday"
+)
+
+// ...
+unsafe := blackfriday.MarkdownCommon(input)
+html := bluemonday.UGCPolicy().SanitizeBytes(unsafe)
+```
+
+### Custom options
+
+If you want to customize the set of options, first get a renderer
+(currently either the HTML or LaTeX output engines), then use it to
+call the more general `Markdown` function. For examples, see the
+implementations of `MarkdownBasic` and `MarkdownCommon` in
+`markdown.go`.
+
+You can also check out `blackfriday-tool` for a more complete example
+of how to use it. Download and install it using:
+
+    go get github.com/russross/blackfriday-tool
+
+This is a simple command-line tool that allows you to process a
+markdown file using a standalone program.  You can also browse the
+source directly on github if you are just looking for some example
+code:
+
+* <http://github.com/russross/blackfriday-tool>
+
+Note that if you have not already done so, installing
+`blackfriday-tool` will be sufficient to download and install
+blackfriday in addition to the tool itself. The tool binary will be
+installed in `$GOPATH/bin`.  This is a statically-linked binary that
+can be copied to wherever you need it without worrying about
+dependencies and library versions.
+
+
+Features
+--------
+
+All features of Sundown are supported, including:
+
+*   **Compatibility**. The Markdown v1.0.3 test suite passes with
+    the `--tidy` option.  Without `--tidy`, the differences are
+    mostly in whitespace and entity escaping, where blackfriday is
+    more consistent and cleaner.
+
+*   **Common extensions**, including table support, fenced code
+    blocks, autolinks, strikethroughs, non-strict emphasis, etc.
+
+*   **Safety**. Blackfriday is paranoid when parsing, making it safe
+    to feed untrusted user input without fear of bad things
+    happening. The test suite stress tests this and there are no
+    known inputs that make it crash.  If you find one, please let me
+    know and send me the input that does it.
+
+    NOTE: "safety" in this context means *runtime safety only*. In order to
+    protect yourself agains JavaScript injection in untrusted content, see
+    [this example](https://github.com/russross/blackfriday#sanitize-untrusted-content).
+
+*   **Fast processing**. It is fast enough to render on-demand in
+    most web applications without having to cache the output.
+
+*   **Thread safety**. You can run multiple parsers in different
+    goroutines without ill effect. There is no dependence on global
+    shared state.
+
+*   **Minimal dependencies**. Blackfriday only depends on standard
+    library packages in Go. The source code is pretty
+    self-contained, so it is easy to add to any project, including
+    Google App Engine projects.
+
+*   **Standards compliant**. Output successfully validates using the
+    W3C validation tool for HTML 4.01 and XHTML 1.0 Transitional.
+
+
+Extensions
+----------
+
+In addition to the standard markdown syntax, this package
+implements the following extensions:
+
+*   **Intra-word emphasis supression**. The `_` character is
+    commonly used inside words when discussing code, so having
+    markdown interpret it as an emphasis command is usually the
+    wrong thing. Blackfriday lets you treat all emphasis markers as
+    normal characters when they occur inside a word.
+
+*   **Tables**. Tables can be created by drawing them in the input
+    using a simple syntax:
+
+    ```
+    Name    | Age
+    --------|------
+    Bob     | 27
+    Alice   | 23
+    ```
+
+*   **Fenced code blocks**. In addition to the normal 4-space
+    indentation to mark code blocks, you can explicitly mark them
+    and supply a language (to make syntax highlighting simple). Just
+    mark it like this:
+
+        ``` go
+        func getTrue() bool {
+            return true
+        }
+        ```
+
+    You can use 3 or more backticks to mark the beginning of the
+    block, and the same number to mark the end of the block.
+
+*   **Autolinking**. Blackfriday can find URLs that have not been
+    explicitly marked as links and turn them into links.
+
+*   **Strikethrough**. Use two tildes (`~~`) to mark text that
+    should be crossed out.
+
+*   **Hard line breaks**. With this extension enabled (it is off by
+    default in the `MarkdownBasic` and `MarkdownCommon` convenience
+    functions), newlines in the input translate into line breaks in
+    the output.
+
+*   **Smart quotes**. Smartypants-style punctuation substitution is
+    supported, turning normal double- and single-quote marks into
+    curly quotes, etc.
+
+*   **LaTeX-style dash parsing** is an additional option, where `--`
+    is translated into `&ndash;`, and `---` is translated into
+    `&mdash;`. This differs from most smartypants processors, which
+    turn a single hyphen into an ndash and a double hyphen into an
+    mdash.
+
+*   **Smart fractions**, where anything that looks like a fraction
+    is translated into suitable HTML (instead of just a few special
+    cases like most smartypant processors). For example, `4/5`
+    becomes `<sup>4</sup>&frasl;<sub>5</sub>`, which renders as
+    <sup>4</sup>&frasl;<sub>5</sub>.
+
+
+Other renderers
+---------------
+
+Blackfriday is structured to allow alternative rendering engines. Here
+are a few of note:
+
+*   [github_flavored_markdown](https://godoc.org/github.com/shurcooL/github_flavored_markdown):
+    provides a GitHub Flavored Markdown renderer with fenced code block
+    highlighting, clickable header anchor links.
+
+    It's not customizable, and its goal is to produce HTML output
+    equivalent to the [GitHub Markdown API endpoint](https://developer.github.com/v3/markdown/#render-a-markdown-document-in-raw-mode),
+    except the rendering is performed locally.
+
+*   [markdownfmt](https://github.com/shurcooL/markdownfmt): like gofmt,
+    but for markdown.
+
+*   LaTeX output: renders output as LaTeX. This is currently part of the
+    main Blackfriday repository, but may be split into its own project
+    in the future. If you are interested in owning and maintaining the
+    LaTeX output component, please be in touch.
+
+    It renders some basic documents, but is only experimental at this
+    point. In particular, it does not do any inline escaping, so input
+    that happens to look like LaTeX code will be passed through without
+    modification.
+
+
+Todo
+----
+
+*   More unit testing
+*   Improve unicode support. It does not understand all unicode
+    rules (about what constitutes a letter, a punctuation symbol,
+    etc.), so it may fail to detect word boundaries correctly in
+    some instances. It is safe on all utf-8 input.
+
+
+License
+-------
+
+[Blackfriday is distributed under the Simplified BSD License](LICENSE.txt)
+
+
+   [1]: http://daringfireball.net/projects/markdown/ "Markdown"
+   [2]: http://golang.org/ "Go Language"
+   [3]: https://github.com/vmg/sundown "Sundown"
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/block.go b/Godeps/_workspace/src/github.com/russross/blackfriday/block.go
new file mode 100644
index 0000000000..1f300b334d
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/block.go
@@ -0,0 +1,1389 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+// Functions to parse block-level elements.
+//
+
+package blackfriday
+
+import (
+	"bytes"
+
+	"github.com/shurcooL/sanitized_anchor_name"
+)
+
+// Parse block-level data.
+// Note: this function and many that it calls assume that
+// the input buffer ends with a newline.
+func (p *parser) block(out *bytes.Buffer, data []byte) {
+	if len(data) == 0 || data[len(data)-1] != '\n' {
+		panic("block input is missing terminating newline")
+	}
+
+	// this is called recursively: enforce a maximum depth
+	if p.nesting >= p.maxNesting {
+		return
+	}
+	p.nesting++
+
+	// parse out one block-level construct at a time
+	for len(data) > 0 {
+		// prefixed header:
+		//
+		// # Header 1
+		// ## Header 2
+		// ...
+		// ###### Header 6
+		if p.isPrefixHeader(data) {
+			data = data[p.prefixHeader(out, data):]
+			continue
+		}
+
+		// block of preformatted HTML:
+		//
+		// <div>
+		//     ...
+		// </div>
+		if data[0] == '<' {
+			if i := p.html(out, data, true); i > 0 {
+				data = data[i:]
+				continue
+			}
+		}
+
+		// title block
+		//
+		// % stuff
+		// % more stuff
+		// % even more stuff
+		if p.flags&EXTENSION_TITLEBLOCK != 0 {
+			if data[0] == '%' {
+				if i := p.titleBlock(out, data, true); i > 0 {
+					data = data[i:]
+					continue
+				}
+			}
+		}
+
+		// blank lines.  note: returns the # of bytes to skip
+		if i := p.isEmpty(data); i > 0 {
+			data = data[i:]
+			continue
+		}
+
+		// indented code block:
+		//
+		//     func max(a, b int) int {
+		//         if a > b {
+		//             return a
+		//         }
+		//         return b
+		//      }
+		if p.codePrefix(data) > 0 {
+			data = data[p.code(out, data):]
+			continue
+		}
+
+		// fenced code block:
+		//
+		// ``` go
+		// func fact(n int) int {
+		//     if n <= 1 {
+		//         return n
+		//     }
+		//     return n * fact(n-1)
+		// }
+		// ```
+		if p.flags&EXTENSION_FENCED_CODE != 0 {
+			if i := p.fencedCode(out, data, true); i > 0 {
+				data = data[i:]
+				continue
+			}
+		}
+
+		// horizontal rule:
+		//
+		// ------
+		// or
+		// ******
+		// or
+		// ______
+		if p.isHRule(data) {
+			p.r.HRule(out)
+			var i int
+			for i = 0; data[i] != '\n'; i++ {
+			}
+			data = data[i:]
+			continue
+		}
+
+		// block quote:
+		//
+		// > A big quote I found somewhere
+		// > on the web
+		if p.quotePrefix(data) > 0 {
+			data = data[p.quote(out, data):]
+			continue
+		}
+
+		// table:
+		//
+		// Name  | Age | Phone
+		// ------|-----|---------
+		// Bob   | 31  | 555-1234
+		// Alice | 27  | 555-4321
+		if p.flags&EXTENSION_TABLES != 0 {
+			if i := p.table(out, data); i > 0 {
+				data = data[i:]
+				continue
+			}
+		}
+
+		// an itemized/unordered list:
+		//
+		// * Item 1
+		// * Item 2
+		//
+		// also works with + or -
+		if p.uliPrefix(data) > 0 {
+			data = data[p.list(out, data, 0):]
+			continue
+		}
+
+		// a numbered/ordered list:
+		//
+		// 1. Item 1
+		// 2. Item 2
+		if p.oliPrefix(data) > 0 {
+			data = data[p.list(out, data, LIST_TYPE_ORDERED):]
+			continue
+		}
+
+		// definition lists:
+		//
+		// Term 1
+		// :   Definition a
+		// :   Definition b
+		//
+		// Term 2
+		// :   Definition c
+		if p.flags&EXTENSION_DEFINITION_LISTS != 0 {
+			if p.dliPrefix(data) > 0 {
+				data = data[p.list(out, data, LIST_TYPE_DEFINITION):]
+				continue
+			}
+		}
+
+		// anything else must look like a normal paragraph
+		// note: this finds underlined headers, too
+		data = data[p.paragraph(out, data):]
+	}
+
+	p.nesting--
+}
+
+func (p *parser) isPrefixHeader(data []byte) bool {
+	if data[0] != '#' {
+		return false
+	}
+
+	if p.flags&EXTENSION_SPACE_HEADERS != 0 {
+		level := 0
+		for level < 6 && data[level] == '#' {
+			level++
+		}
+		if data[level] != ' ' {
+			return false
+		}
+	}
+	return true
+}
+
+func (p *parser) prefixHeader(out *bytes.Buffer, data []byte) int {
+	level := 0
+	for level < 6 && data[level] == '#' {
+		level++
+	}
+	i := skipChar(data, level, ' ')
+	end := skipUntilChar(data, i, '\n')
+	skip := end
+	id := ""
+	if p.flags&EXTENSION_HEADER_IDS != 0 {
+		j, k := 0, 0
+		// find start/end of header id
+		for j = i; j < end-1 && (data[j] != '{' || data[j+1] != '#'); j++ {
+		}
+		for k = j + 1; k < end && data[k] != '}'; k++ {
+		}
+		// extract header id iff found
+		if j < end && k < end {
+			id = string(data[j+2 : k])
+			end = j
+			skip = k + 1
+			for end > 0 && data[end-1] == ' ' {
+				end--
+			}
+		}
+	}
+	for end > 0 && data[end-1] == '#' {
+		if isBackslashEscaped(data, end-1) {
+			break
+		}
+		end--
+	}
+	for end > 0 && data[end-1] == ' ' {
+		end--
+	}
+	if end > i {
+		if id == "" && p.flags&EXTENSION_AUTO_HEADER_IDS != 0 {
+			id = sanitized_anchor_name.Create(string(data[i:end]))
+		}
+		work := func() bool {
+			p.inline(out, data[i:end])
+			return true
+		}
+		p.r.Header(out, work, level, id)
+	}
+	return skip
+}
+
+func (p *parser) isUnderlinedHeader(data []byte) int {
+	// test of level 1 header
+	if data[0] == '=' {
+		i := skipChar(data, 1, '=')
+		i = skipChar(data, i, ' ')
+		if data[i] == '\n' {
+			return 1
+		} else {
+			return 0
+		}
+	}
+
+	// test of level 2 header
+	if data[0] == '-' {
+		i := skipChar(data, 1, '-')
+		i = skipChar(data, i, ' ')
+		if data[i] == '\n' {
+			return 2
+		} else {
+			return 0
+		}
+	}
+
+	return 0
+}
+
+func (p *parser) titleBlock(out *bytes.Buffer, data []byte, doRender bool) int {
+	if data[0] != '%' {
+		return 0
+	}
+	splitData := bytes.Split(data, []byte("\n"))
+	var i int
+	for idx, b := range splitData {
+		if !bytes.HasPrefix(b, []byte("%")) {
+			i = idx // - 1
+			break
+		}
+	}
+
+	data = bytes.Join(splitData[0:i], []byte("\n"))
+	p.r.TitleBlock(out, data)
+
+	return len(data)
+}
+
+func (p *parser) html(out *bytes.Buffer, data []byte, doRender bool) int {
+	var i, j int
+
+	// identify the opening tag
+	if data[0] != '<' {
+		return 0
+	}
+	curtag, tagfound := p.htmlFindTag(data[1:])
+
+	// handle special cases
+	if !tagfound {
+		// check for an HTML comment
+		if size := p.htmlComment(out, data, doRender); size > 0 {
+			return size
+		}
+
+		// check for an <hr> tag
+		if size := p.htmlHr(out, data, doRender); size > 0 {
+			return size
+		}
+
+		// no special case recognized
+		return 0
+	}
+
+	// look for an unindented matching closing tag
+	// followed by a blank line
+	found := false
+	/*
+		closetag := []byte("\n</" + curtag + ">")
+		j = len(curtag) + 1
+		for !found {
+			// scan for a closing tag at the beginning of a line
+			if skip := bytes.Index(data[j:], closetag); skip >= 0 {
+				j += skip + len(closetag)
+			} else {
+				break
+			}
+
+			// see if it is the only thing on the line
+			if skip := p.isEmpty(data[j:]); skip > 0 {
+				// see if it is followed by a blank line/eof
+				j += skip
+				if j >= len(data) {
+					found = true
+					i = j
+				} else {
+					if skip := p.isEmpty(data[j:]); skip > 0 {
+						j += skip
+						found = true
+						i = j
+					}
+				}
+			}
+		}
+	*/
+
+	// if not found, try a second pass looking for indented match
+	// but not if tag is "ins" or "del" (following original Markdown.pl)
+	if !found && curtag != "ins" && curtag != "del" {
+		i = 1
+		for i < len(data) {
+			i++
+			for i < len(data) && !(data[i-1] == '<' && data[i] == '/') {
+				i++
+			}
+
+			if i+2+len(curtag) >= len(data) {
+				break
+			}
+
+			j = p.htmlFindEnd(curtag, data[i-1:])
+
+			if j > 0 {
+				i += j - 1
+				found = true
+				break
+			}
+		}
+	}
+
+	if !found {
+		return 0
+	}
+
+	// the end of the block has been found
+	if doRender {
+		// trim newlines
+		end := i
+		for end > 0 && data[end-1] == '\n' {
+			end--
+		}
+		p.r.BlockHtml(out, data[:end])
+	}
+
+	return i
+}
+
+// HTML comment, lax form
+func (p *parser) htmlComment(out *bytes.Buffer, data []byte, doRender bool) int {
+	if data[0] != '<' || data[1] != '!' || data[2] != '-' || data[3] != '-' {
+		return 0
+	}
+
+	i := 5
+
+	// scan for an end-of-comment marker, across lines if necessary
+	for i < len(data) && !(data[i-2] == '-' && data[i-1] == '-' && data[i] == '>') {
+		i++
+	}
+	i++
+
+	// no end-of-comment marker
+	if i >= len(data) {
+		return 0
+	}
+
+	// needs to end with a blank line
+	if j := p.isEmpty(data[i:]); j > 0 {
+		size := i + j
+		if doRender {
+			// trim trailing newlines
+			end := size
+			for end > 0 && data[end-1] == '\n' {
+				end--
+			}
+			p.r.BlockHtml(out, data[:end])
+		}
+		return size
+	}
+
+	return 0
+}
+
+// HR, which is the only self-closing block tag considered
+func (p *parser) htmlHr(out *bytes.Buffer, data []byte, doRender bool) int {
+	if data[0] != '<' || (data[1] != 'h' && data[1] != 'H') || (data[2] != 'r' && data[2] != 'R') {
+		return 0
+	}
+	if data[3] != ' ' && data[3] != '/' && data[3] != '>' {
+		// not an <hr> tag after all; at least not a valid one
+		return 0
+	}
+
+	i := 3
+	for data[i] != '>' && data[i] != '\n' {
+		i++
+	}
+
+	if data[i] == '>' {
+		i++
+		if j := p.isEmpty(data[i:]); j > 0 {
+			size := i + j
+			if doRender {
+				// trim newlines
+				end := size
+				for end > 0 && data[end-1] == '\n' {
+					end--
+				}
+				p.r.BlockHtml(out, data[:end])
+			}
+			return size
+		}
+	}
+
+	return 0
+}
+
+func (p *parser) htmlFindTag(data []byte) (string, bool) {
+	i := 0
+	for isalnum(data[i]) {
+		i++
+	}
+	key := string(data[:i])
+	if blockTags[key] {
+		return key, true
+	}
+	return "", false
+}
+
+func (p *parser) htmlFindEnd(tag string, data []byte) int {
+	// assume data[0] == '<' && data[1] == '/' already tested
+
+	// check if tag is a match
+	closetag := []byte("</" + tag + ">")
+	if !bytes.HasPrefix(data, closetag) {
+		return 0
+	}
+	i := len(closetag)
+
+	// check that the rest of the line is blank
+	skip := 0
+	if skip = p.isEmpty(data[i:]); skip == 0 {
+		return 0
+	}
+	i += skip
+	skip = 0
+
+	if i >= len(data) {
+		return i
+	}
+
+	if p.flags&EXTENSION_LAX_HTML_BLOCKS != 0 {
+		return i
+	}
+	if skip = p.isEmpty(data[i:]); skip == 0 {
+		// following line must be blank
+		return 0
+	}
+
+	return i + skip
+}
+
+func (p *parser) isEmpty(data []byte) int {
+	// it is okay to call isEmpty on an empty buffer
+	if len(data) == 0 {
+		return 0
+	}
+
+	var i int
+	for i = 0; i < len(data) && data[i] != '\n'; i++ {
+		if data[i] != ' ' && data[i] != '\t' {
+			return 0
+		}
+	}
+	return i + 1
+}
+
+func (p *parser) isHRule(data []byte) bool {
+	i := 0
+
+	// skip up to three spaces
+	for i < 3 && data[i] == ' ' {
+		i++
+	}
+
+	// look at the hrule char
+	if data[i] != '*' && data[i] != '-' && data[i] != '_' {
+		return false
+	}
+	c := data[i]
+
+	// the whole line must be the char or whitespace
+	n := 0
+	for data[i] != '\n' {
+		switch {
+		case data[i] == c:
+			n++
+		case data[i] != ' ':
+			return false
+		}
+		i++
+	}
+
+	return n >= 3
+}
+
+func (p *parser) isFencedCode(data []byte, syntax **string, oldmarker string) (skip int, marker string) {
+	i, size := 0, 0
+	skip = 0
+
+	// skip up to three spaces
+	for i < len(data) && i < 3 && data[i] == ' ' {
+		i++
+	}
+	if i >= len(data) {
+		return
+	}
+
+	// check for the marker characters: ~ or `
+	if data[i] != '~' && data[i] != '`' {
+		return
+	}
+
+	c := data[i]
+
+	// the whole line must be the same char or whitespace
+	for i < len(data) && data[i] == c {
+		size++
+		i++
+	}
+
+	if i >= len(data) {
+		return
+	}
+
+	// the marker char must occur at least 3 times
+	if size < 3 {
+		return
+	}
+	marker = string(data[i-size : i])
+
+	// if this is the end marker, it must match the beginning marker
+	if oldmarker != "" && marker != oldmarker {
+		return
+	}
+
+	if syntax != nil {
+		syn := 0
+		i = skipChar(data, i, ' ')
+
+		if i >= len(data) {
+			return
+		}
+
+		syntaxStart := i
+
+		if data[i] == '{' {
+			i++
+			syntaxStart++
+
+			for i < len(data) && data[i] != '}' && data[i] != '\n' {
+				syn++
+				i++
+			}
+
+			if i >= len(data) || data[i] != '}' {
+				return
+			}
+
+			// strip all whitespace at the beginning and the end
+			// of the {} block
+			for syn > 0 && isspace(data[syntaxStart]) {
+				syntaxStart++
+				syn--
+			}
+
+			for syn > 0 && isspace(data[syntaxStart+syn-1]) {
+				syn--
+			}
+
+			i++
+		} else {
+			for i < len(data) && !isspace(data[i]) {
+				syn++
+				i++
+			}
+		}
+
+		language := string(data[syntaxStart : syntaxStart+syn])
+		*syntax = &language
+	}
+
+	i = skipChar(data, i, ' ')
+	if i >= len(data) || data[i] != '\n' {
+		return
+	}
+
+	skip = i + 1
+	return
+}
+
+func (p *parser) fencedCode(out *bytes.Buffer, data []byte, doRender bool) int {
+	var lang *string
+	beg, marker := p.isFencedCode(data, &lang, "")
+	if beg == 0 || beg >= len(data) {
+		return 0
+	}
+
+	var work bytes.Buffer
+
+	for {
+		// safe to assume beg < len(data)
+
+		// check for the end of the code block
+		fenceEnd, _ := p.isFencedCode(data[beg:], nil, marker)
+		if fenceEnd != 0 {
+			beg += fenceEnd
+			break
+		}
+
+		// copy the current line
+		end := skipUntilChar(data, beg, '\n') + 1
+
+		// did we reach the end of the buffer without a closing marker?
+		if end >= len(data) {
+			return 0
+		}
+
+		// verbatim copy to the working buffer
+		if doRender {
+			work.Write(data[beg:end])
+		}
+		beg = end
+	}
+
+	syntax := ""
+	if lang != nil {
+		syntax = *lang
+	}
+
+	if doRender {
+		p.r.BlockCode(out, work.Bytes(), syntax)
+	}
+
+	return beg
+}
+
+func (p *parser) table(out *bytes.Buffer, data []byte) int {
+	var header bytes.Buffer
+	i, columns := p.tableHeader(&header, data)
+	if i == 0 {
+		return 0
+	}
+
+	var body bytes.Buffer
+
+	for i < len(data) {
+		pipes, rowStart := 0, i
+		for ; data[i] != '\n'; i++ {
+			if data[i] == '|' {
+				pipes++
+			}
+		}
+
+		if pipes == 0 {
+			i = rowStart
+			break
+		}
+
+		// include the newline in data sent to tableRow
+		i++
+		p.tableRow(&body, data[rowStart:i], columns, false)
+	}
+
+	p.r.Table(out, header.Bytes(), body.Bytes(), columns)
+
+	return i
+}
+
+// check if the specified position is preceded by an odd number of backslashes
+func isBackslashEscaped(data []byte, i int) bool {
+	backslashes := 0
+	for i-backslashes-1 >= 0 && data[i-backslashes-1] == '\\' {
+		backslashes++
+	}
+	return backslashes&1 == 1
+}
+
+func (p *parser) tableHeader(out *bytes.Buffer, data []byte) (size int, columns []int) {
+	i := 0
+	colCount := 1
+	for i = 0; data[i] != '\n'; i++ {
+		if data[i] == '|' && !isBackslashEscaped(data, i) {
+			colCount++
+		}
+	}
+
+	// doesn't look like a table header
+	if colCount == 1 {
+		return
+	}
+
+	// include the newline in the data sent to tableRow
+	header := data[:i+1]
+
+	// column count ignores pipes at beginning or end of line
+	if data[0] == '|' {
+		colCount--
+	}
+	if i > 2 && data[i-1] == '|' && !isBackslashEscaped(data, i-1) {
+		colCount--
+	}
+
+	columns = make([]int, colCount)
+
+	// move on to the header underline
+	i++
+	if i >= len(data) {
+		return
+	}
+
+	if data[i] == '|' && !isBackslashEscaped(data, i) {
+		i++
+	}
+	i = skipChar(data, i, ' ')
+
+	// each column header is of form: / *:?-+:? *|/ with # dashes + # colons >= 3
+	// and trailing | optional on last column
+	col := 0
+	for data[i] != '\n' {
+		dashes := 0
+
+		if data[i] == ':' {
+			i++
+			columns[col] |= TABLE_ALIGNMENT_LEFT
+			dashes++
+		}
+		for data[i] == '-' {
+			i++
+			dashes++
+		}
+		if data[i] == ':' {
+			i++
+			columns[col] |= TABLE_ALIGNMENT_RIGHT
+			dashes++
+		}
+		for data[i] == ' ' {
+			i++
+		}
+
+		// end of column test is messy
+		switch {
+		case dashes < 3:
+			// not a valid column
+			return
+
+		case data[i] == '|' && !isBackslashEscaped(data, i):
+			// marker found, now skip past trailing whitespace
+			col++
+			i++
+			for data[i] == ' ' {
+				i++
+			}
+
+			// trailing junk found after last column
+			if col >= colCount && data[i] != '\n' {
+				return
+			}
+
+		case (data[i] != '|' || isBackslashEscaped(data, i)) && col+1 < colCount:
+			// something else found where marker was required
+			return
+
+		case data[i] == '\n':
+			// marker is optional for the last column
+			col++
+
+		default:
+			// trailing junk found after last column
+			return
+		}
+	}
+	if col != colCount {
+		return
+	}
+
+	p.tableRow(out, header, columns, true)
+	size = i + 1
+	return
+}
+
+func (p *parser) tableRow(out *bytes.Buffer, data []byte, columns []int, header bool) {
+	i, col := 0, 0
+	var rowWork bytes.Buffer
+
+	if data[i] == '|' && !isBackslashEscaped(data, i) {
+		i++
+	}
+
+	for col = 0; col < len(columns) && i < len(data); col++ {
+		for data[i] == ' ' {
+			i++
+		}
+
+		cellStart := i
+
+		for (data[i] != '|' || isBackslashEscaped(data, i)) && data[i] != '\n' {
+			i++
+		}
+
+		cellEnd := i
+
+		// skip the end-of-cell marker, possibly taking us past end of buffer
+		i++
+
+		for cellEnd > cellStart && data[cellEnd-1] == ' ' {
+			cellEnd--
+		}
+
+		var cellWork bytes.Buffer
+		p.inline(&cellWork, data[cellStart:cellEnd])
+
+		if header {
+			p.r.TableHeaderCell(&rowWork, cellWork.Bytes(), columns[col])
+		} else {
+			p.r.TableCell(&rowWork, cellWork.Bytes(), columns[col])
+		}
+	}
+
+	// pad it out with empty columns to get the right number
+	for ; col < len(columns); col++ {
+		if header {
+			p.r.TableHeaderCell(&rowWork, nil, columns[col])
+		} else {
+			p.r.TableCell(&rowWork, nil, columns[col])
+		}
+	}
+
+	// silently ignore rows with too many cells
+
+	p.r.TableRow(out, rowWork.Bytes())
+}
+
+// returns blockquote prefix length
+func (p *parser) quotePrefix(data []byte) int {
+	i := 0
+	for i < 3 && data[i] == ' ' {
+		i++
+	}
+	if data[i] == '>' {
+		if data[i+1] == ' ' {
+			return i + 2
+		}
+		return i + 1
+	}
+	return 0
+}
+
+// parse a blockquote fragment
+func (p *parser) quote(out *bytes.Buffer, data []byte) int {
+	var raw bytes.Buffer
+	beg, end := 0, 0
+	for beg < len(data) {
+		end = beg
+		for data[end] != '\n' {
+			end++
+		}
+		end++
+
+		if pre := p.quotePrefix(data[beg:]); pre > 0 {
+			// skip the prefix
+			beg += pre
+		} else if p.isEmpty(data[beg:]) > 0 &&
+			(end >= len(data) ||
+				(p.quotePrefix(data[end:]) == 0 && p.isEmpty(data[end:]) == 0)) {
+			// blockquote ends with at least one blank line
+			// followed by something without a blockquote prefix
+			break
+		}
+
+		// this line is part of the blockquote
+		raw.Write(data[beg:end])
+		beg = end
+	}
+
+	var cooked bytes.Buffer
+	p.block(&cooked, raw.Bytes())
+	p.r.BlockQuote(out, cooked.Bytes())
+	return end
+}
+
+// returns prefix length for block code
+func (p *parser) codePrefix(data []byte) int {
+	if data[0] == ' ' && data[1] == ' ' && data[2] == ' ' && data[3] == ' ' {
+		return 4
+	}
+	return 0
+}
+
+func (p *parser) code(out *bytes.Buffer, data []byte) int {
+	var work bytes.Buffer
+
+	i := 0
+	for i < len(data) {
+		beg := i
+		for data[i] != '\n' {
+			i++
+		}
+		i++
+
+		blankline := p.isEmpty(data[beg:i]) > 0
+		if pre := p.codePrefix(data[beg:i]); pre > 0 {
+			beg += pre
+		} else if !blankline {
+			// non-empty, non-prefixed line breaks the pre
+			i = beg
+			break
+		}
+
+		// verbatim copy to the working buffeu
+		if blankline {
+			work.WriteByte('\n')
+		} else {
+			work.Write(data[beg:i])
+		}
+	}
+
+	// trim all the \n off the end of work
+	workbytes := work.Bytes()
+	eol := len(workbytes)
+	for eol > 0 && workbytes[eol-1] == '\n' {
+		eol--
+	}
+	if eol != len(workbytes) {
+		work.Truncate(eol)
+	}
+
+	work.WriteByte('\n')
+
+	p.r.BlockCode(out, work.Bytes(), "")
+
+	return i
+}
+
+// returns unordered list item prefix
+func (p *parser) uliPrefix(data []byte) int {
+	i := 0
+
+	// start with up to 3 spaces
+	for i < 3 && data[i] == ' ' {
+		i++
+	}
+
+	// need a *, +, or - followed by a space
+	if (data[i] != '*' && data[i] != '+' && data[i] != '-') ||
+		data[i+1] != ' ' {
+		return 0
+	}
+	return i + 2
+}
+
+// returns ordered list item prefix
+func (p *parser) oliPrefix(data []byte) int {
+	i := 0
+
+	// start with up to 3 spaces
+	for i < 3 && data[i] == ' ' {
+		i++
+	}
+
+	// count the digits
+	start := i
+	for data[i] >= '0' && data[i] <= '9' {
+		i++
+	}
+
+	// we need >= 1 digits followed by a dot and a space
+	if start == i || data[i] != '.' || data[i+1] != ' ' {
+		return 0
+	}
+	return i + 2
+}
+
+// returns definition list item prefix
+func (p *parser) dliPrefix(data []byte) int {
+	i := 0
+
+	// need a : followed by a spaces
+	if data[i] != ':' || data[i+1] != ' ' {
+		return 0
+	}
+	for data[i] == ' ' {
+		i++
+	}
+	return i + 2
+}
+
+// parse ordered or unordered list block
+func (p *parser) list(out *bytes.Buffer, data []byte, flags int) int {
+	i := 0
+	flags |= LIST_ITEM_BEGINNING_OF_LIST
+	work := func() bool {
+		for i < len(data) {
+			skip := p.listItem(out, data[i:], &flags)
+			i += skip
+
+			if skip == 0 || flags&LIST_ITEM_END_OF_LIST != 0 {
+				break
+			}
+			flags &= ^LIST_ITEM_BEGINNING_OF_LIST
+		}
+		return true
+	}
+
+	p.r.List(out, work, flags)
+	return i
+}
+
+// Parse a single list item.
+// Assumes initial prefix is already removed if this is a sublist.
+func (p *parser) listItem(out *bytes.Buffer, data []byte, flags *int) int {
+	// keep track of the indentation of the first line
+	itemIndent := 0
+	for itemIndent < 3 && data[itemIndent] == ' ' {
+		itemIndent++
+	}
+
+	i := p.uliPrefix(data)
+	if i == 0 {
+		i = p.oliPrefix(data)
+	}
+	if i == 0 {
+		i = p.dliPrefix(data)
+		// reset definition term flag
+		if i > 0 {
+			*flags &= ^LIST_TYPE_TERM
+		}
+	}
+	if i == 0 {
+		// if in defnition list, set term flag and continue
+		if *flags&LIST_TYPE_DEFINITION != 0 {
+			*flags |= LIST_TYPE_TERM
+		} else {
+			return 0
+		}
+	}
+
+	// skip leading whitespace on first line
+	for data[i] == ' ' {
+		i++
+	}
+
+	// find the end of the line
+	line := i
+	for i > 0 && data[i-1] != '\n' {
+		i++
+	}
+
+	// get working buffer
+	var raw bytes.Buffer
+
+	// put the first line into the working buffer
+	raw.Write(data[line:i])
+	line = i
+
+	// process the following lines
+	containsBlankLine := false
+	sublist := 0
+
+gatherlines:
+	for line < len(data) {
+		i++
+
+		// find the end of this line
+		for data[i-1] != '\n' {
+			i++
+		}
+
+		// if it is an empty line, guess that it is part of this item
+		// and move on to the next line
+		if p.isEmpty(data[line:i]) > 0 {
+			containsBlankLine = true
+			line = i
+			continue
+		}
+
+		// calculate the indentation
+		indent := 0
+		for indent < 4 && line+indent < i && data[line+indent] == ' ' {
+			indent++
+		}
+
+		chunk := data[line+indent : i]
+
+		// evaluate how this line fits in
+		switch {
+		// is this a nested list item?
+		case (p.uliPrefix(chunk) > 0 && !p.isHRule(chunk)) ||
+			p.oliPrefix(chunk) > 0 ||
+			p.dliPrefix(chunk) > 0:
+
+			if containsBlankLine {
+				*flags |= LIST_ITEM_CONTAINS_BLOCK
+			}
+
+			// to be a nested list, it must be indented more
+			// if not, it is the next item in the same list
+			if indent <= itemIndent {
+				break gatherlines
+			}
+
+			// is this the first item in the nested list?
+			if sublist == 0 {
+				sublist = raw.Len()
+			}
+
+		// is this a nested prefix header?
+		case p.isPrefixHeader(chunk):
+			// if the header is not indented, it is not nested in the list
+			// and thus ends the list
+			if containsBlankLine && indent < 4 {
+				*flags |= LIST_ITEM_END_OF_LIST
+				break gatherlines
+			}
+			*flags |= LIST_ITEM_CONTAINS_BLOCK
+
+		// anything following an empty line is only part
+		// of this item if it is indented 4 spaces
+		// (regardless of the indentation of the beginning of the item)
+		case containsBlankLine && indent < 4:
+			if *flags&LIST_TYPE_DEFINITION != 0 && i < len(data)-1 {
+				// is the next item still a part of this list?
+				next := i
+				for data[next] != '\n' {
+					next++
+				}
+				for next < len(data)-1 && data[next] == '\n' {
+					next++
+				}
+				if i < len(data)-1 && data[i] != ':' && data[next] != ':' {
+					*flags |= LIST_ITEM_END_OF_LIST
+				}
+			} else {
+				*flags |= LIST_ITEM_END_OF_LIST
+			}
+			break gatherlines
+
+		// a blank line means this should be parsed as a block
+		case containsBlankLine:
+			raw.WriteByte('\n')
+			*flags |= LIST_ITEM_CONTAINS_BLOCK
+		}
+
+		// if this line was preceeded by one or more blanks,
+		// re-introduce the blank into the buffer
+		if containsBlankLine {
+			containsBlankLine = false
+			raw.WriteByte('\n')
+
+		}
+
+		// add the line into the working buffer without prefix
+		raw.Write(data[line+indent : i])
+
+		line = i
+	}
+
+	rawBytes := raw.Bytes()
+
+	// render the contents of the list item
+	var cooked bytes.Buffer
+	if *flags&LIST_ITEM_CONTAINS_BLOCK != 0 && *flags&LIST_TYPE_TERM == 0 {
+		// intermediate render of block item, except for definition term
+		if sublist > 0 {
+			p.block(&cooked, rawBytes[:sublist])
+			p.block(&cooked, rawBytes[sublist:])
+		} else {
+			p.block(&cooked, rawBytes)
+		}
+	} else {
+		// intermediate render of inline item
+		if sublist > 0 {
+			p.inline(&cooked, rawBytes[:sublist])
+			p.block(&cooked, rawBytes[sublist:])
+		} else {
+			p.inline(&cooked, rawBytes)
+		}
+	}
+
+	// render the actual list item
+	cookedBytes := cooked.Bytes()
+	parsedEnd := len(cookedBytes)
+
+	// strip trailing newlines
+	for parsedEnd > 0 && cookedBytes[parsedEnd-1] == '\n' {
+		parsedEnd--
+	}
+	p.r.ListItem(out, cookedBytes[:parsedEnd], *flags)
+
+	return line
+}
+
+// render a single paragraph that has already been parsed out
+func (p *parser) renderParagraph(out *bytes.Buffer, data []byte) {
+	if len(data) == 0 {
+		return
+	}
+
+	// trim leading spaces
+	beg := 0
+	for data[beg] == ' ' {
+		beg++
+	}
+
+	// trim trailing newline
+	end := len(data) - 1
+
+	// trim trailing spaces
+	for end > beg && data[end-1] == ' ' {
+		end--
+	}
+
+	work := func() bool {
+		p.inline(out, data[beg:end])
+		return true
+	}
+	p.r.Paragraph(out, work)
+}
+
+func (p *parser) paragraph(out *bytes.Buffer, data []byte) int {
+	// prev: index of 1st char of previous line
+	// line: index of 1st char of current line
+	// i: index of cursor/end of current line
+	var prev, line, i int
+
+	// keep going until we find something to mark the end of the paragraph
+	for i < len(data) {
+		// mark the beginning of the current line
+		prev = line
+		current := data[i:]
+		line = i
+
+		// did we find a blank line marking the end of the paragraph?
+		if n := p.isEmpty(current); n > 0 {
+			// did this blank line followed by a definition list item?
+			if p.flags&EXTENSION_DEFINITION_LISTS != 0 {
+				if i < len(data)-1 && data[i+1] == ':' {
+					return p.list(out, data[prev:], LIST_TYPE_DEFINITION)
+				}
+			}
+
+			p.renderParagraph(out, data[:i])
+			return i + n
+		}
+
+		// an underline under some text marks a header, so our paragraph ended on prev line
+		if i > 0 {
+			if level := p.isUnderlinedHeader(current); level > 0 {
+				// render the paragraph
+				p.renderParagraph(out, data[:prev])
+
+				// ignore leading and trailing whitespace
+				eol := i - 1
+				for prev < eol && data[prev] == ' ' {
+					prev++
+				}
+				for eol > prev && data[eol-1] == ' ' {
+					eol--
+				}
+
+				// render the header
+				// this ugly double closure avoids forcing variables onto the heap
+				work := func(o *bytes.Buffer, pp *parser, d []byte) func() bool {
+					return func() bool {
+						pp.inline(o, d)
+						return true
+					}
+				}(out, p, data[prev:eol])
+
+				id := ""
+				if p.flags&EXTENSION_AUTO_HEADER_IDS != 0 {
+					id = sanitized_anchor_name.Create(string(data[prev:eol]))
+				}
+
+				p.r.Header(out, work, level, id)
+
+				// find the end of the underline
+				for data[i] != '\n' {
+					i++
+				}
+				return i
+			}
+		}
+
+		// if the next line starts a block of HTML, then the paragraph ends here
+		if p.flags&EXTENSION_LAX_HTML_BLOCKS != 0 {
+			if data[i] == '<' && p.html(out, current, false) > 0 {
+				// rewind to before the HTML block
+				p.renderParagraph(out, data[:i])
+				return i
+			}
+		}
+
+		// if there's a prefixed header or a horizontal rule after this, paragraph is over
+		if p.isPrefixHeader(current) || p.isHRule(current) {
+			p.renderParagraph(out, data[:i])
+			return i
+		}
+
+		// if there's a definition list item, prev line is a definition term
+		if p.flags&EXTENSION_DEFINITION_LISTS != 0 {
+			if p.dliPrefix(current) != 0 {
+				return p.list(out, data[prev:], LIST_TYPE_DEFINITION)
+			}
+		}
+
+		// if there's a list after this, paragraph is over
+		if p.flags&EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK != 0 {
+			if p.uliPrefix(current) != 0 ||
+				p.oliPrefix(current) != 0 ||
+				p.quotePrefix(current) != 0 ||
+				p.codePrefix(current) != 0 {
+				p.renderParagraph(out, data[:i])
+				return i
+			}
+		}
+
+		// otherwise, scan to the beginning of the next line
+		for data[i] != '\n' {
+			i++
+		}
+		i++
+	}
+
+	p.renderParagraph(out, data[:i])
+	return i
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/html.go b/Godeps/_workspace/src/github.com/russross/blackfriday/html.go
new file mode 100644
index 0000000000..264aae5870
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/html.go
@@ -0,0 +1,948 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+//
+// HTML rendering backend
+//
+//
+
+package blackfriday
+
+import (
+	"bytes"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// Html renderer configuration options.
+const (
+	HTML_SKIP_HTML                 = 1 << iota // skip preformatted HTML blocks
+	HTML_SKIP_STYLE                            // skip embedded <style> elements
+	HTML_SKIP_IMAGES                           // skip embedded images
+	HTML_SKIP_LINKS                            // skip all links
+	HTML_SAFELINK                              // only link to trusted protocols
+	HTML_NOFOLLOW_LINKS                        // only link with rel="nofollow"
+	HTML_NOREFERRER_LINKS                      // only link with rel="noreferrer"
+	HTML_HREF_TARGET_BLANK                     // add a blank target
+	HTML_TOC                                   // generate a table of contents
+	HTML_OMIT_CONTENTS                         // skip the main contents (for a standalone table of contents)
+	HTML_COMPLETE_PAGE                         // generate a complete HTML page
+	HTML_USE_XHTML                             // generate XHTML output instead of HTML
+	HTML_USE_SMARTYPANTS                       // enable smart punctuation substitutions
+	HTML_SMARTYPANTS_FRACTIONS                 // enable smart fractions (with HTML_USE_SMARTYPANTS)
+	HTML_SMARTYPANTS_LATEX_DASHES              // enable LaTeX-style dashes (with HTML_USE_SMARTYPANTS)
+	HTML_SMARTYPANTS_ANGLED_QUOTES             // enable angled double quotes (with HTML_USE_SMARTYPANTS) for double quotes rendering
+	HTML_FOOTNOTE_RETURN_LINKS                 // generate a link at the end of a footnote to return to the source
+)
+
+var (
+	alignments = []string{
+		"left",
+		"right",
+		"center",
+	}
+
+	// TODO: improve this regexp to catch all possible entities:
+	htmlEntity = regexp.MustCompile(`&[a-z]{2,5};`)
+)
+
+type HtmlRendererParameters struct {
+	// Prepend this text to each relative URL.
+	AbsolutePrefix string
+	// Add this text to each footnote anchor, to ensure uniqueness.
+	FootnoteAnchorPrefix string
+	// Show this text inside the <a> tag for a footnote return link, if the
+	// HTML_FOOTNOTE_RETURN_LINKS flag is enabled. If blank, the string
+	// <sup>[return]</sup> is used.
+	FootnoteReturnLinkContents string
+	// If set, add this text to the front of each Header ID, to ensure
+	// uniqueness.
+	HeaderIDPrefix string
+	// If set, add this text to the back of each Header ID, to ensure uniqueness.
+	HeaderIDSuffix string
+}
+
+// Html is a type that implements the Renderer interface for HTML output.
+//
+// Do not create this directly, instead use the HtmlRenderer function.
+type Html struct {
+	flags    int    // HTML_* options
+	closeTag string // how to end singleton tags: either " />" or ">"
+	title    string // document title
+	css      string // optional css file url (used with HTML_COMPLETE_PAGE)
+
+	parameters HtmlRendererParameters
+
+	// table of contents data
+	tocMarker    int
+	headerCount  int
+	currentLevel int
+	toc          *bytes.Buffer
+
+	// Track header IDs to prevent ID collision in a single generation.
+	headerIDs map[string]int
+
+	smartypants *smartypantsRenderer
+}
+
+const (
+	xhtmlClose = " />"
+	htmlClose  = ">"
+)
+
+// HtmlRenderer creates and configures an Html object, which
+// satisfies the Renderer interface.
+//
+// flags is a set of HTML_* options ORed together.
+// title is the title of the document, and css is a URL for the document's
+// stylesheet.
+// title and css are only used when HTML_COMPLETE_PAGE is selected.
+func HtmlRenderer(flags int, title string, css string) Renderer {
+	return HtmlRendererWithParameters(flags, title, css, HtmlRendererParameters{})
+}
+
+func HtmlRendererWithParameters(flags int, title string,
+	css string, renderParameters HtmlRendererParameters) Renderer {
+	// configure the rendering engine
+	closeTag := htmlClose
+	if flags&HTML_USE_XHTML != 0 {
+		closeTag = xhtmlClose
+	}
+
+	if renderParameters.FootnoteReturnLinkContents == "" {
+		renderParameters.FootnoteReturnLinkContents = `<sup>[return]</sup>`
+	}
+
+	return &Html{
+		flags:      flags,
+		closeTag:   closeTag,
+		title:      title,
+		css:        css,
+		parameters: renderParameters,
+
+		headerCount:  0,
+		currentLevel: 0,
+		toc:          new(bytes.Buffer),
+
+		headerIDs: make(map[string]int),
+
+		smartypants: smartypants(flags),
+	}
+}
+
+// Using if statements is a bit faster than a switch statement. As the compiler
+// improves, this should be unnecessary this is only worthwhile because
+// attrEscape is the single largest CPU user in normal use.
+// Also tried using map, but that gave a ~3x slowdown.
+func escapeSingleChar(char byte) (string, bool) {
+	if char == '"' {
+		return "&quot;", true
+	}
+	if char == '&' {
+		return "&amp;", true
+	}
+	if char == '<' {
+		return "&lt;", true
+	}
+	if char == '>' {
+		return "&gt;", true
+	}
+	return "", false
+}
+
+func attrEscape(out *bytes.Buffer, src []byte) {
+	org := 0
+	for i, ch := range src {
+		if entity, ok := escapeSingleChar(ch); ok {
+			if i > org {
+				// copy all the normal characters since the last escape
+				out.Write(src[org:i])
+			}
+			org = i + 1
+			out.WriteString(entity)
+		}
+	}
+	if org < len(src) {
+		out.Write(src[org:])
+	}
+}
+
+func entityEscapeWithSkip(out *bytes.Buffer, src []byte, skipRanges [][]int) {
+	end := 0
+	for _, rang := range skipRanges {
+		attrEscape(out, src[end:rang[0]])
+		out.Write(src[rang[0]:rang[1]])
+		end = rang[1]
+	}
+	attrEscape(out, src[end:])
+}
+
+func (options *Html) GetFlags() int {
+	return options.flags
+}
+
+func (options *Html) TitleBlock(out *bytes.Buffer, text []byte) {
+	text = bytes.TrimPrefix(text, []byte("% "))
+	text = bytes.Replace(text, []byte("\n% "), []byte("\n"), -1)
+	out.WriteString("<h1 class=\"title\">")
+	out.Write(text)
+	out.WriteString("\n</h1>")
+}
+
+func (options *Html) Header(out *bytes.Buffer, text func() bool, level int, id string) {
+	marker := out.Len()
+	doubleSpace(out)
+
+	if id == "" && options.flags&HTML_TOC != 0 {
+		id = fmt.Sprintf("toc_%d", options.headerCount)
+	}
+
+	if id != "" {
+		id = options.ensureUniqueHeaderID(id)
+
+		if options.parameters.HeaderIDPrefix != "" {
+			id = options.parameters.HeaderIDPrefix + id
+		}
+
+		if options.parameters.HeaderIDSuffix != "" {
+			id = id + options.parameters.HeaderIDSuffix
+		}
+
+		out.WriteString(fmt.Sprintf("<h%d id=\"%s\">", level, id))
+	} else {
+		out.WriteString(fmt.Sprintf("<h%d>", level))
+	}
+
+	tocMarker := out.Len()
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+
+	// are we building a table of contents?
+	if options.flags&HTML_TOC != 0 {
+		options.TocHeaderWithAnchor(out.Bytes()[tocMarker:], level, id)
+	}
+
+	out.WriteString(fmt.Sprintf("</h%d>\n", level))
+}
+
+func (options *Html) BlockHtml(out *bytes.Buffer, text []byte) {
+	if options.flags&HTML_SKIP_HTML != 0 {
+		return
+	}
+
+	doubleSpace(out)
+	out.Write(text)
+	out.WriteByte('\n')
+}
+
+func (options *Html) HRule(out *bytes.Buffer) {
+	doubleSpace(out)
+	out.WriteString("<hr")
+	out.WriteString(options.closeTag)
+	out.WriteByte('\n')
+}
+
+func (options *Html) BlockCode(out *bytes.Buffer, text []byte, lang string) {
+	doubleSpace(out)
+
+	// parse out the language names/classes
+	count := 0
+	for _, elt := range strings.Fields(lang) {
+		if elt[0] == '.' {
+			elt = elt[1:]
+		}
+		if len(elt) == 0 {
+			continue
+		}
+		if count == 0 {
+			out.WriteString("<pre><code class=\"language-")
+		} else {
+			out.WriteByte(' ')
+		}
+		attrEscape(out, []byte(elt))
+		count++
+	}
+
+	if count == 0 {
+		out.WriteString("<pre><code>")
+	} else {
+		out.WriteString("\">")
+	}
+
+	attrEscape(out, text)
+	out.WriteString("</code></pre>\n")
+}
+
+func (options *Html) BlockQuote(out *bytes.Buffer, text []byte) {
+	doubleSpace(out)
+	out.WriteString("<blockquote>\n")
+	out.Write(text)
+	out.WriteString("</blockquote>\n")
+}
+
+func (options *Html) Table(out *bytes.Buffer, header []byte, body []byte, columnData []int) {
+	doubleSpace(out)
+	out.WriteString("<table>\n<thead>\n")
+	out.Write(header)
+	out.WriteString("</thead>\n\n<tbody>\n")
+	out.Write(body)
+	out.WriteString("</tbody>\n</table>\n")
+}
+
+func (options *Html) TableRow(out *bytes.Buffer, text []byte) {
+	doubleSpace(out)
+	out.WriteString("<tr>\n")
+	out.Write(text)
+	out.WriteString("\n</tr>\n")
+}
+
+func (options *Html) TableHeaderCell(out *bytes.Buffer, text []byte, align int) {
+	doubleSpace(out)
+	switch align {
+	case TABLE_ALIGNMENT_LEFT:
+		out.WriteString("<th align=\"left\">")
+	case TABLE_ALIGNMENT_RIGHT:
+		out.WriteString("<th align=\"right\">")
+	case TABLE_ALIGNMENT_CENTER:
+		out.WriteString("<th align=\"center\">")
+	default:
+		out.WriteString("<th>")
+	}
+
+	out.Write(text)
+	out.WriteString("</th>")
+}
+
+func (options *Html) TableCell(out *bytes.Buffer, text []byte, align int) {
+	doubleSpace(out)
+	switch align {
+	case TABLE_ALIGNMENT_LEFT:
+		out.WriteString("<td align=\"left\">")
+	case TABLE_ALIGNMENT_RIGHT:
+		out.WriteString("<td align=\"right\">")
+	case TABLE_ALIGNMENT_CENTER:
+		out.WriteString("<td align=\"center\">")
+	default:
+		out.WriteString("<td>")
+	}
+
+	out.Write(text)
+	out.WriteString("</td>")
+}
+
+func (options *Html) Footnotes(out *bytes.Buffer, text func() bool) {
+	out.WriteString("<div class=\"footnotes\">\n")
+	options.HRule(out)
+	options.List(out, text, LIST_TYPE_ORDERED)
+	out.WriteString("</div>\n")
+}
+
+func (options *Html) FootnoteItem(out *bytes.Buffer, name, text []byte, flags int) {
+	if flags&LIST_ITEM_CONTAINS_BLOCK != 0 || flags&LIST_ITEM_BEGINNING_OF_LIST != 0 {
+		doubleSpace(out)
+	}
+	slug := slugify(name)
+	out.WriteString(`<li id="`)
+	out.WriteString(`fn:`)
+	out.WriteString(options.parameters.FootnoteAnchorPrefix)
+	out.Write(slug)
+	out.WriteString(`">`)
+	out.Write(text)
+	if options.flags&HTML_FOOTNOTE_RETURN_LINKS != 0 {
+		out.WriteString(` <a class="footnote-return" href="#`)
+		out.WriteString(`fnref:`)
+		out.WriteString(options.parameters.FootnoteAnchorPrefix)
+		out.Write(slug)
+		out.WriteString(`">`)
+		out.WriteString(options.parameters.FootnoteReturnLinkContents)
+		out.WriteString(`</a>`)
+	}
+	out.WriteString("</li>\n")
+}
+
+func (options *Html) List(out *bytes.Buffer, text func() bool, flags int) {
+	marker := out.Len()
+	doubleSpace(out)
+
+	if flags&LIST_TYPE_DEFINITION != 0 {
+		out.WriteString("<dl>")
+	} else if flags&LIST_TYPE_ORDERED != 0 {
+		out.WriteString("<ol>")
+	} else {
+		out.WriteString("<ul>")
+	}
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	if flags&LIST_TYPE_DEFINITION != 0 {
+		out.WriteString("</dl>\n")
+	} else if flags&LIST_TYPE_ORDERED != 0 {
+		out.WriteString("</ol>\n")
+	} else {
+		out.WriteString("</ul>\n")
+	}
+}
+
+func (options *Html) ListItem(out *bytes.Buffer, text []byte, flags int) {
+	if (flags&LIST_ITEM_CONTAINS_BLOCK != 0 && flags&LIST_TYPE_DEFINITION == 0) ||
+		flags&LIST_ITEM_BEGINNING_OF_LIST != 0 {
+		doubleSpace(out)
+	}
+	if flags&LIST_TYPE_TERM != 0 {
+		out.WriteString("<dt>")
+	} else if flags&LIST_TYPE_DEFINITION != 0 {
+		out.WriteString("<dd>")
+	} else {
+		out.WriteString("<li>")
+	}
+	out.Write(text)
+	if flags&LIST_TYPE_TERM != 0 {
+		out.WriteString("</dt>\n")
+	} else if flags&LIST_TYPE_DEFINITION != 0 {
+		out.WriteString("</dd>\n")
+	} else {
+		out.WriteString("</li>\n")
+	}
+}
+
+func (options *Html) Paragraph(out *bytes.Buffer, text func() bool) {
+	marker := out.Len()
+	doubleSpace(out)
+
+	out.WriteString("<p>")
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	out.WriteString("</p>\n")
+}
+
+func (options *Html) AutoLink(out *bytes.Buffer, link []byte, kind int) {
+	skipRanges := htmlEntity.FindAllIndex(link, -1)
+	if options.flags&HTML_SAFELINK != 0 && !isSafeLink(link) && kind != LINK_TYPE_EMAIL {
+		// mark it but don't link it if it is not a safe link: no smartypants
+		out.WriteString("<tt>")
+		entityEscapeWithSkip(out, link, skipRanges)
+		out.WriteString("</tt>")
+		return
+	}
+
+	out.WriteString("<a href=\"")
+	if kind == LINK_TYPE_EMAIL {
+		out.WriteString("mailto:")
+	} else {
+		options.maybeWriteAbsolutePrefix(out, link)
+	}
+
+	entityEscapeWithSkip(out, link, skipRanges)
+
+	var relAttrs []string
+	if options.flags&HTML_NOFOLLOW_LINKS != 0 && !isRelativeLink(link) {
+		relAttrs = append(relAttrs, "nofollow")
+	}
+	if options.flags&HTML_NOREFERRER_LINKS != 0 && !isRelativeLink(link) {
+		relAttrs = append(relAttrs, "noreferrer")
+	}
+	if len(relAttrs) > 0 {
+		out.WriteString(fmt.Sprintf("\" rel=\"%s", strings.Join(relAttrs, " ")))
+	}
+
+	// blank target only add to external link
+	if options.flags&HTML_HREF_TARGET_BLANK != 0 && !isRelativeLink(link) {
+		out.WriteString("\" target=\"_blank")
+	}
+
+	out.WriteString("\">")
+
+	// Pretty print: if we get an email address as
+	// an actual URI, e.g. `mailto:foo@bar.com`, we don't
+	// want to print the `mailto:` prefix
+	switch {
+	case bytes.HasPrefix(link, []byte("mailto://")):
+		attrEscape(out, link[len("mailto://"):])
+	case bytes.HasPrefix(link, []byte("mailto:")):
+		attrEscape(out, link[len("mailto:"):])
+	default:
+		entityEscapeWithSkip(out, link, skipRanges)
+	}
+
+	out.WriteString("</a>")
+}
+
+func (options *Html) CodeSpan(out *bytes.Buffer, text []byte) {
+	out.WriteString("<code>")
+	attrEscape(out, text)
+	out.WriteString("</code>")
+}
+
+func (options *Html) DoubleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("<strong>")
+	out.Write(text)
+	out.WriteString("</strong>")
+}
+
+func (options *Html) Emphasis(out *bytes.Buffer, text []byte) {
+	if len(text) == 0 {
+		return
+	}
+	out.WriteString("<em>")
+	out.Write(text)
+	out.WriteString("</em>")
+}
+
+func (options *Html) maybeWriteAbsolutePrefix(out *bytes.Buffer, link []byte) {
+	if options.parameters.AbsolutePrefix != "" && isRelativeLink(link) && link[0] != '.' {
+		out.WriteString(options.parameters.AbsolutePrefix)
+		if link[0] != '/' {
+			out.WriteByte('/')
+		}
+	}
+}
+
+func (options *Html) Image(out *bytes.Buffer, link []byte, title []byte, alt []byte) {
+	if options.flags&HTML_SKIP_IMAGES != 0 {
+		return
+	}
+
+	out.WriteString("<img src=\"")
+	options.maybeWriteAbsolutePrefix(out, link)
+	attrEscape(out, link)
+	out.WriteString("\" alt=\"")
+	if len(alt) > 0 {
+		attrEscape(out, alt)
+	}
+	if len(title) > 0 {
+		out.WriteString("\" title=\"")
+		attrEscape(out, title)
+	}
+
+	out.WriteByte('"')
+	out.WriteString(options.closeTag)
+}
+
+func (options *Html) LineBreak(out *bytes.Buffer) {
+	out.WriteString("<br")
+	out.WriteString(options.closeTag)
+	out.WriteByte('\n')
+}
+
+func (options *Html) Link(out *bytes.Buffer, link []byte, title []byte, content []byte) {
+	if options.flags&HTML_SKIP_LINKS != 0 {
+		// write the link text out but don't link it, just mark it with typewriter font
+		out.WriteString("<tt>")
+		attrEscape(out, content)
+		out.WriteString("</tt>")
+		return
+	}
+
+	if options.flags&HTML_SAFELINK != 0 && !isSafeLink(link) {
+		// write the link text out but don't link it, just mark it with typewriter font
+		out.WriteString("<tt>")
+		attrEscape(out, content)
+		out.WriteString("</tt>")
+		return
+	}
+
+	out.WriteString("<a href=\"")
+	options.maybeWriteAbsolutePrefix(out, link)
+	attrEscape(out, link)
+	if len(title) > 0 {
+		out.WriteString("\" title=\"")
+		attrEscape(out, title)
+	}
+	var relAttrs []string
+	if options.flags&HTML_NOFOLLOW_LINKS != 0 && !isRelativeLink(link) {
+		relAttrs = append(relAttrs, "nofollow")
+	}
+	if options.flags&HTML_NOREFERRER_LINKS != 0 && !isRelativeLink(link) {
+		relAttrs = append(relAttrs, "noreferrer")
+	}
+	if len(relAttrs) > 0 {
+		out.WriteString(fmt.Sprintf("\" rel=\"%s", strings.Join(relAttrs, " ")))
+	}
+
+	// blank target only add to external link
+	if options.flags&HTML_HREF_TARGET_BLANK != 0 && !isRelativeLink(link) {
+		out.WriteString("\" target=\"_blank")
+	}
+
+	out.WriteString("\">")
+	out.Write(content)
+	out.WriteString("</a>")
+	return
+}
+
+func (options *Html) RawHtmlTag(out *bytes.Buffer, text []byte) {
+	if options.flags&HTML_SKIP_HTML != 0 {
+		return
+	}
+	if options.flags&HTML_SKIP_STYLE != 0 && isHtmlTag(text, "style") {
+		return
+	}
+	if options.flags&HTML_SKIP_LINKS != 0 && isHtmlTag(text, "a") {
+		return
+	}
+	if options.flags&HTML_SKIP_IMAGES != 0 && isHtmlTag(text, "img") {
+		return
+	}
+	out.Write(text)
+}
+
+func (options *Html) TripleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("<strong><em>")
+	out.Write(text)
+	out.WriteString("</em></strong>")
+}
+
+func (options *Html) StrikeThrough(out *bytes.Buffer, text []byte) {
+	out.WriteString("<del>")
+	out.Write(text)
+	out.WriteString("</del>")
+}
+
+func (options *Html) FootnoteRef(out *bytes.Buffer, ref []byte, id int) {
+	slug := slugify(ref)
+	out.WriteString(`<sup class="footnote-ref" id="`)
+	out.WriteString(`fnref:`)
+	out.WriteString(options.parameters.FootnoteAnchorPrefix)
+	out.Write(slug)
+	out.WriteString(`"><a rel="footnote" href="#`)
+	out.WriteString(`fn:`)
+	out.WriteString(options.parameters.FootnoteAnchorPrefix)
+	out.Write(slug)
+	out.WriteString(`">`)
+	out.WriteString(strconv.Itoa(id))
+	out.WriteString(`</a></sup>`)
+}
+
+func (options *Html) Entity(out *bytes.Buffer, entity []byte) {
+	out.Write(entity)
+}
+
+func (options *Html) NormalText(out *bytes.Buffer, text []byte) {
+	if options.flags&HTML_USE_SMARTYPANTS != 0 {
+		options.Smartypants(out, text)
+	} else {
+		attrEscape(out, text)
+	}
+}
+
+func (options *Html) Smartypants(out *bytes.Buffer, text []byte) {
+	smrt := smartypantsData{false, false}
+
+	// first do normal entity escaping
+	var escaped bytes.Buffer
+	attrEscape(&escaped, text)
+	text = escaped.Bytes()
+
+	mark := 0
+	for i := 0; i < len(text); i++ {
+		if action := options.smartypants[text[i]]; action != nil {
+			if i > mark {
+				out.Write(text[mark:i])
+			}
+
+			previousChar := byte(0)
+			if i > 0 {
+				previousChar = text[i-1]
+			}
+			i += action(out, &smrt, previousChar, text[i:])
+			mark = i + 1
+		}
+	}
+
+	if mark < len(text) {
+		out.Write(text[mark:])
+	}
+}
+
+func (options *Html) DocumentHeader(out *bytes.Buffer) {
+	if options.flags&HTML_COMPLETE_PAGE == 0 {
+		return
+	}
+
+	ending := ""
+	if options.flags&HTML_USE_XHTML != 0 {
+		out.WriteString("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" ")
+		out.WriteString("\"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n")
+		out.WriteString("<html xmlns=\"http://www.w3.org/1999/xhtml\">\n")
+		ending = " /"
+	} else {
+		out.WriteString("<!DOCTYPE html>\n")
+		out.WriteString("<html>\n")
+	}
+	out.WriteString("<head>\n")
+	out.WriteString("  <title>")
+	options.NormalText(out, []byte(options.title))
+	out.WriteString("</title>\n")
+	out.WriteString("  <meta name=\"GENERATOR\" content=\"Blackfriday Markdown Processor v")
+	out.WriteString(VERSION)
+	out.WriteString("\"")
+	out.WriteString(ending)
+	out.WriteString(">\n")
+	out.WriteString("  <meta charset=\"utf-8\"")
+	out.WriteString(ending)
+	out.WriteString(">\n")
+	if options.css != "" {
+		out.WriteString("  <link rel=\"stylesheet\" type=\"text/css\" href=\"")
+		attrEscape(out, []byte(options.css))
+		out.WriteString("\"")
+		out.WriteString(ending)
+		out.WriteString(">\n")
+	}
+	out.WriteString("</head>\n")
+	out.WriteString("<body>\n")
+
+	options.tocMarker = out.Len()
+}
+
+func (options *Html) DocumentFooter(out *bytes.Buffer) {
+	// finalize and insert the table of contents
+	if options.flags&HTML_TOC != 0 {
+		options.TocFinalize()
+
+		// now we have to insert the table of contents into the document
+		var temp bytes.Buffer
+
+		// start by making a copy of everything after the document header
+		temp.Write(out.Bytes()[options.tocMarker:])
+
+		// now clear the copied material from the main output buffer
+		out.Truncate(options.tocMarker)
+
+		// corner case spacing issue
+		if options.flags&HTML_COMPLETE_PAGE != 0 {
+			out.WriteByte('\n')
+		}
+
+		// insert the table of contents
+		out.WriteString("<nav>\n")
+		out.Write(options.toc.Bytes())
+		out.WriteString("</nav>\n")
+
+		// corner case spacing issue
+		if options.flags&HTML_COMPLETE_PAGE == 0 && options.flags&HTML_OMIT_CONTENTS == 0 {
+			out.WriteByte('\n')
+		}
+
+		// write out everything that came after it
+		if options.flags&HTML_OMIT_CONTENTS == 0 {
+			out.Write(temp.Bytes())
+		}
+	}
+
+	if options.flags&HTML_COMPLETE_PAGE != 0 {
+		out.WriteString("\n</body>\n")
+		out.WriteString("</html>\n")
+	}
+
+}
+
+func (options *Html) TocHeaderWithAnchor(text []byte, level int, anchor string) {
+	for level > options.currentLevel {
+		switch {
+		case bytes.HasSuffix(options.toc.Bytes(), []byte("</li>\n")):
+			// this sublist can nest underneath a header
+			size := options.toc.Len()
+			options.toc.Truncate(size - len("</li>\n"))
+
+		case options.currentLevel > 0:
+			options.toc.WriteString("<li>")
+		}
+		if options.toc.Len() > 0 {
+			options.toc.WriteByte('\n')
+		}
+		options.toc.WriteString("<ul>\n")
+		options.currentLevel++
+	}
+
+	for level < options.currentLevel {
+		options.toc.WriteString("</ul>")
+		if options.currentLevel > 1 {
+			options.toc.WriteString("</li>\n")
+		}
+		options.currentLevel--
+	}
+
+	options.toc.WriteString("<li><a href=\"#")
+	if anchor != "" {
+		options.toc.WriteString(anchor)
+	} else {
+		options.toc.WriteString("toc_")
+		options.toc.WriteString(strconv.Itoa(options.headerCount))
+	}
+	options.toc.WriteString("\">")
+	options.headerCount++
+
+	options.toc.Write(text)
+
+	options.toc.WriteString("</a></li>\n")
+}
+
+func (options *Html) TocHeader(text []byte, level int) {
+	options.TocHeaderWithAnchor(text, level, "")
+}
+
+func (options *Html) TocFinalize() {
+	for options.currentLevel > 1 {
+		options.toc.WriteString("</ul></li>\n")
+		options.currentLevel--
+	}
+
+	if options.currentLevel > 0 {
+		options.toc.WriteString("</ul>\n")
+	}
+}
+
+func isHtmlTag(tag []byte, tagname string) bool {
+	found, _ := findHtmlTagPos(tag, tagname)
+	return found
+}
+
+// Look for a character, but ignore it when it's in any kind of quotes, it
+// might be JavaScript
+func skipUntilCharIgnoreQuotes(html []byte, start int, char byte) int {
+	inSingleQuote := false
+	inDoubleQuote := false
+	inGraveQuote := false
+	i := start
+	for i < len(html) {
+		switch {
+		case html[i] == char && !inSingleQuote && !inDoubleQuote && !inGraveQuote:
+			return i
+		case html[i] == '\'':
+			inSingleQuote = !inSingleQuote
+		case html[i] == '"':
+			inDoubleQuote = !inDoubleQuote
+		case html[i] == '`':
+			inGraveQuote = !inGraveQuote
+		}
+		i++
+	}
+	return start
+}
+
+func findHtmlTagPos(tag []byte, tagname string) (bool, int) {
+	i := 0
+	if i < len(tag) && tag[0] != '<' {
+		return false, -1
+	}
+	i++
+	i = skipSpace(tag, i)
+
+	if i < len(tag) && tag[i] == '/' {
+		i++
+	}
+
+	i = skipSpace(tag, i)
+	j := 0
+	for ; i < len(tag); i, j = i+1, j+1 {
+		if j >= len(tagname) {
+			break
+		}
+
+		if strings.ToLower(string(tag[i]))[0] != tagname[j] {
+			return false, -1
+		}
+	}
+
+	if i == len(tag) {
+		return false, -1
+	}
+
+	rightAngle := skipUntilCharIgnoreQuotes(tag, i, '>')
+	if rightAngle > i {
+		return true, rightAngle
+	}
+
+	return false, -1
+}
+
+func skipUntilChar(text []byte, start int, char byte) int {
+	i := start
+	for i < len(text) && text[i] != char {
+		i++
+	}
+	return i
+}
+
+func skipSpace(tag []byte, i int) int {
+	for i < len(tag) && isspace(tag[i]) {
+		i++
+	}
+	return i
+}
+
+func skipChar(data []byte, start int, char byte) int {
+	i := start
+	for i < len(data) && data[i] == char {
+		i++
+	}
+	return i
+}
+
+func doubleSpace(out *bytes.Buffer) {
+	if out.Len() > 0 {
+		out.WriteByte('\n')
+	}
+}
+
+func isRelativeLink(link []byte) (yes bool) {
+	// a tag begin with '#'
+	if link[0] == '#' {
+		return true
+	}
+
+	// link begin with '/' but not '//', the second maybe a protocol relative link
+	if len(link) >= 2 && link[0] == '/' && link[1] != '/' {
+		return true
+	}
+
+	// only the root '/'
+	if len(link) == 1 && link[0] == '/' {
+		return true
+	}
+
+	// current directory : begin with "./"
+	if bytes.HasPrefix(link, []byte("./")) {
+		return true
+	}
+
+	// parent directory : begin with "../"
+	if bytes.HasPrefix(link, []byte("../")) {
+		return true
+	}
+
+	return false
+}
+
+func (options *Html) ensureUniqueHeaderID(id string) string {
+	for count, found := options.headerIDs[id]; found; count, found = options.headerIDs[id] {
+		tmp := fmt.Sprintf("%s-%d", id, count+1)
+
+		if _, tmpFound := options.headerIDs[tmp]; !tmpFound {
+			options.headerIDs[id] = count + 1
+			id = tmp
+		} else {
+			id = id + "-1"
+		}
+	}
+
+	if _, found := options.headerIDs[id]; !found {
+		options.headerIDs[id] = 0
+	}
+
+	return id
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/inline.go b/Godeps/_workspace/src/github.com/russross/blackfriday/inline.go
new file mode 100644
index 0000000000..3f39b525a0
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/inline.go
@@ -0,0 +1,1103 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+// Functions to parse inline elements.
+//
+
+package blackfriday
+
+import (
+	"bytes"
+	"regexp"
+	"strconv"
+)
+
+var (
+	urlRe    = `((https?|ftp):\/\/|\/)[-A-Za-z0-9+&@#\/%?=~_|!:,.;\(\)]+`
+	anchorRe = regexp.MustCompile(`^(<a\shref="` + urlRe + `"(\stitle="[^"<>]+")?\s?>` + urlRe + `<\/a>)`)
+)
+
+// Functions to parse text within a block
+// Each function returns the number of chars taken care of
+// data is the complete block being rendered
+// offset is the number of valid chars before the current cursor
+
+func (p *parser) inline(out *bytes.Buffer, data []byte) {
+	// this is called recursively: enforce a maximum depth
+	if p.nesting >= p.maxNesting {
+		return
+	}
+	p.nesting++
+
+	i, end := 0, 0
+	for i < len(data) {
+		// copy inactive chars into the output
+		for end < len(data) && p.inlineCallback[data[end]] == nil {
+			end++
+		}
+
+		p.r.NormalText(out, data[i:end])
+
+		if end >= len(data) {
+			break
+		}
+		i = end
+
+		// call the trigger
+		handler := p.inlineCallback[data[end]]
+		if consumed := handler(p, out, data, i); consumed == 0 {
+			// no action from the callback; buffer the byte for later
+			end = i + 1
+		} else {
+			// skip past whatever the callback used
+			i += consumed
+			end = i
+		}
+	}
+
+	p.nesting--
+}
+
+// single and double emphasis parsing
+func emphasis(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	data = data[offset:]
+	c := data[0]
+	ret := 0
+
+	if len(data) > 2 && data[1] != c {
+		// whitespace cannot follow an opening emphasis;
+		// strikethrough only takes two characters '~~'
+		if c == '~' || isspace(data[1]) {
+			return 0
+		}
+		if ret = helperEmphasis(p, out, data[1:], c); ret == 0 {
+			return 0
+		}
+
+		return ret + 1
+	}
+
+	if len(data) > 3 && data[1] == c && data[2] != c {
+		if isspace(data[2]) {
+			return 0
+		}
+		if ret = helperDoubleEmphasis(p, out, data[2:], c); ret == 0 {
+			return 0
+		}
+
+		return ret + 2
+	}
+
+	if len(data) > 4 && data[1] == c && data[2] == c && data[3] != c {
+		if c == '~' || isspace(data[3]) {
+			return 0
+		}
+		if ret = helperTripleEmphasis(p, out, data, 3, c); ret == 0 {
+			return 0
+		}
+
+		return ret + 3
+	}
+
+	return 0
+}
+
+func codeSpan(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	data = data[offset:]
+
+	nb := 0
+
+	// count the number of backticks in the delimiter
+	for nb < len(data) && data[nb] == '`' {
+		nb++
+	}
+
+	// find the next delimiter
+	i, end := 0, 0
+	for end = nb; end < len(data) && i < nb; end++ {
+		if data[end] == '`' {
+			i++
+		} else {
+			i = 0
+		}
+	}
+
+	// no matching delimiter?
+	if i < nb && end >= len(data) {
+		return 0
+	}
+
+	// trim outside whitespace
+	fBegin := nb
+	for fBegin < end && data[fBegin] == ' ' {
+		fBegin++
+	}
+
+	fEnd := end - nb
+	for fEnd > fBegin && data[fEnd-1] == ' ' {
+		fEnd--
+	}
+
+	// render the code span
+	if fBegin != fEnd {
+		p.r.CodeSpan(out, data[fBegin:fEnd])
+	}
+
+	return end
+
+}
+
+// newline preceded by two spaces becomes <br>
+// newline without two spaces works when EXTENSION_HARD_LINE_BREAK is enabled
+func lineBreak(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	// remove trailing spaces from out
+	outBytes := out.Bytes()
+	end := len(outBytes)
+	eol := end
+	for eol > 0 && outBytes[eol-1] == ' ' {
+		eol--
+	}
+	out.Truncate(eol)
+
+	precededByTwoSpaces := offset >= 2 && data[offset-2] == ' ' && data[offset-1] == ' '
+	precededByBackslash := offset >= 1 && data[offset-1] == '\\' // see http://spec.commonmark.org/0.18/#example-527
+	precededByBackslash = precededByBackslash && p.flags&EXTENSION_BACKSLASH_LINE_BREAK != 0
+
+	// should there be a hard line break here?
+	if p.flags&EXTENSION_HARD_LINE_BREAK == 0 && !precededByTwoSpaces && !precededByBackslash {
+		return 0
+	}
+
+	if precededByBackslash && eol > 0 {
+		out.Truncate(eol - 1)
+	}
+	p.r.LineBreak(out)
+	return 1
+}
+
+type linkType int
+
+const (
+	linkNormal linkType = iota
+	linkImg
+	linkDeferredFootnote
+	linkInlineFootnote
+)
+
+// '[': parse a link or an image or a footnote
+func link(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	// no links allowed inside regular links, footnote, and deferred footnotes
+	if p.insideLink && (offset > 0 && data[offset-1] == '[' || len(data)-1 > offset && data[offset+1] == '^') {
+		return 0
+	}
+
+	// [text] == regular link
+	// ![alt] == image
+	// ^[text] == inline footnote
+	// [^refId] == deferred footnote
+	var t linkType
+	if offset > 0 && data[offset-1] == '!' {
+		t = linkImg
+	} else if p.flags&EXTENSION_FOOTNOTES != 0 {
+		if offset > 0 && data[offset-1] == '^' {
+			t = linkInlineFootnote
+		} else if len(data)-1 > offset && data[offset+1] == '^' {
+			t = linkDeferredFootnote
+		}
+	}
+
+	data = data[offset:]
+
+	var (
+		i                       = 1
+		noteId                  int
+		title, link, altContent []byte
+		textHasNl               = false
+	)
+
+	if t == linkDeferredFootnote {
+		i++
+	}
+
+	// look for the matching closing bracket
+	for level := 1; level > 0 && i < len(data); i++ {
+		switch {
+		case data[i] == '\n':
+			textHasNl = true
+
+		case data[i-1] == '\\':
+			continue
+
+		case data[i] == '[':
+			level++
+
+		case data[i] == ']':
+			level--
+			if level <= 0 {
+				i-- // compensate for extra i++ in for loop
+			}
+		}
+	}
+
+	if i >= len(data) {
+		return 0
+	}
+
+	txtE := i
+	i++
+
+	// skip any amount of whitespace or newline
+	// (this is much more lax than original markdown syntax)
+	for i < len(data) && isspace(data[i]) {
+		i++
+	}
+
+	// inline style link
+	switch {
+	case i < len(data) && data[i] == '(':
+		// skip initial whitespace
+		i++
+
+		for i < len(data) && isspace(data[i]) {
+			i++
+		}
+
+		linkB := i
+
+		// look for link end: ' " )
+	findlinkend:
+		for i < len(data) {
+			switch {
+			case data[i] == '\\':
+				i += 2
+
+			case data[i] == ')' || data[i] == '\'' || data[i] == '"':
+				break findlinkend
+
+			default:
+				i++
+			}
+		}
+
+		if i >= len(data) {
+			return 0
+		}
+		linkE := i
+
+		// look for title end if present
+		titleB, titleE := 0, 0
+		if data[i] == '\'' || data[i] == '"' {
+			i++
+			titleB = i
+
+		findtitleend:
+			for i < len(data) {
+				switch {
+				case data[i] == '\\':
+					i += 2
+
+				case data[i] == ')':
+					break findtitleend
+
+				default:
+					i++
+				}
+			}
+
+			if i >= len(data) {
+				return 0
+			}
+
+			// skip whitespace after title
+			titleE = i - 1
+			for titleE > titleB && isspace(data[titleE]) {
+				titleE--
+			}
+
+			// check for closing quote presence
+			if data[titleE] != '\'' && data[titleE] != '"' {
+				titleB, titleE = 0, 0
+				linkE = i
+			}
+		}
+
+		// remove whitespace at the end of the link
+		for linkE > linkB && isspace(data[linkE-1]) {
+			linkE--
+		}
+
+		// remove optional angle brackets around the link
+		if data[linkB] == '<' {
+			linkB++
+		}
+		if data[linkE-1] == '>' {
+			linkE--
+		}
+
+		// build escaped link and title
+		if linkE > linkB {
+			link = data[linkB:linkE]
+		}
+
+		if titleE > titleB {
+			title = data[titleB:titleE]
+		}
+
+		i++
+
+	// reference style link
+	case i < len(data)-1 && data[i] == '[' && data[i+1] != '^':
+		var id []byte
+		altContentConsidered := false
+
+		// look for the id
+		i++
+		linkB := i
+		for i < len(data) && data[i] != ']' {
+			i++
+		}
+		if i >= len(data) {
+			return 0
+		}
+		linkE := i
+
+		// find the reference
+		if linkB == linkE {
+			if textHasNl {
+				var b bytes.Buffer
+
+				for j := 1; j < txtE; j++ {
+					switch {
+					case data[j] != '\n':
+						b.WriteByte(data[j])
+					case data[j-1] != ' ':
+						b.WriteByte(' ')
+					}
+				}
+
+				id = b.Bytes()
+			} else {
+				id = data[1:txtE]
+				altContentConsidered = true
+			}
+		} else {
+			id = data[linkB:linkE]
+		}
+
+		// find the reference with matching id
+		lr, ok := p.getRef(string(id))
+		if !ok {
+			return 0
+
+		}
+
+		// keep link and title from reference
+		link = lr.link
+		title = lr.title
+		if altContentConsidered {
+			altContent = lr.text
+		}
+		i++
+
+	// shortcut reference style link or reference or inline footnote
+	default:
+		var id []byte
+
+		// craft the id
+		if textHasNl {
+			var b bytes.Buffer
+
+			for j := 1; j < txtE; j++ {
+				switch {
+				case data[j] != '\n':
+					b.WriteByte(data[j])
+				case data[j-1] != ' ':
+					b.WriteByte(' ')
+				}
+			}
+
+			id = b.Bytes()
+		} else {
+			if t == linkDeferredFootnote {
+				id = data[2:txtE] // get rid of the ^
+			} else {
+				id = data[1:txtE]
+			}
+		}
+
+		if t == linkInlineFootnote {
+			// create a new reference
+			noteId = len(p.notes) + 1
+
+			var fragment []byte
+			if len(id) > 0 {
+				if len(id) < 16 {
+					fragment = make([]byte, len(id))
+				} else {
+					fragment = make([]byte, 16)
+				}
+				copy(fragment, slugify(id))
+			} else {
+				fragment = append([]byte("footnote-"), []byte(strconv.Itoa(noteId))...)
+			}
+
+			ref := &reference{
+				noteId:   noteId,
+				hasBlock: false,
+				link:     fragment,
+				title:    id,
+			}
+
+			p.notes = append(p.notes, ref)
+
+			link = ref.link
+			title = ref.title
+		} else {
+			// find the reference with matching id
+			lr, ok := p.getRef(string(id))
+			if !ok {
+				return 0
+			}
+
+			if t == linkDeferredFootnote {
+				lr.noteId = len(p.notes) + 1
+				p.notes = append(p.notes, lr)
+			}
+
+			// keep link and title from reference
+			link = lr.link
+			// if inline footnote, title == footnote contents
+			title = lr.title
+			noteId = lr.noteId
+		}
+
+		// rewind the whitespace
+		i = txtE + 1
+	}
+
+	// build content: img alt is escaped, link content is parsed
+	var content bytes.Buffer
+	if txtE > 1 {
+		if t == linkImg {
+			content.Write(data[1:txtE])
+		} else {
+			// links cannot contain other links, so turn off link parsing temporarily
+			insideLink := p.insideLink
+			p.insideLink = true
+			p.inline(&content, data[1:txtE])
+			p.insideLink = insideLink
+		}
+	}
+
+	var uLink []byte
+	if t == linkNormal || t == linkImg {
+		if len(link) > 0 {
+			var uLinkBuf bytes.Buffer
+			unescapeText(&uLinkBuf, link)
+			uLink = uLinkBuf.Bytes()
+		}
+
+		// links need something to click on and somewhere to go
+		if len(uLink) == 0 || (t == linkNormal && content.Len() == 0) {
+			return 0
+		}
+	}
+
+	// call the relevant rendering function
+	switch t {
+	case linkNormal:
+		if len(altContent) > 0 {
+			p.r.Link(out, uLink, title, altContent)
+		} else {
+			p.r.Link(out, uLink, title, content.Bytes())
+		}
+
+	case linkImg:
+		outSize := out.Len()
+		outBytes := out.Bytes()
+		if outSize > 0 && outBytes[outSize-1] == '!' {
+			out.Truncate(outSize - 1)
+		}
+
+		p.r.Image(out, uLink, title, content.Bytes())
+
+	case linkInlineFootnote:
+		outSize := out.Len()
+		outBytes := out.Bytes()
+		if outSize > 0 && outBytes[outSize-1] == '^' {
+			out.Truncate(outSize - 1)
+		}
+
+		p.r.FootnoteRef(out, link, noteId)
+
+	case linkDeferredFootnote:
+		p.r.FootnoteRef(out, link, noteId)
+
+	default:
+		return 0
+	}
+
+	return i
+}
+
+// '<' when tags or autolinks are allowed
+func leftAngle(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	data = data[offset:]
+	altype := LINK_TYPE_NOT_AUTOLINK
+	end := tagLength(data, &altype)
+
+	if end > 2 {
+		if altype != LINK_TYPE_NOT_AUTOLINK {
+			var uLink bytes.Buffer
+			unescapeText(&uLink, data[1:end+1-2])
+			if uLink.Len() > 0 {
+				p.r.AutoLink(out, uLink.Bytes(), altype)
+			}
+		} else {
+			p.r.RawHtmlTag(out, data[:end])
+		}
+	}
+
+	return end
+}
+
+// '\\' backslash escape
+var escapeChars = []byte("\\`*_{}[]()#+-.!:|&<>~")
+
+func escape(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	data = data[offset:]
+
+	if len(data) > 1 {
+		if bytes.IndexByte(escapeChars, data[1]) < 0 {
+			return 0
+		}
+
+		p.r.NormalText(out, data[1:2])
+	}
+
+	return 2
+}
+
+func unescapeText(ob *bytes.Buffer, src []byte) {
+	i := 0
+	for i < len(src) {
+		org := i
+		for i < len(src) && src[i] != '\\' {
+			i++
+		}
+
+		if i > org {
+			ob.Write(src[org:i])
+		}
+
+		if i+1 >= len(src) {
+			break
+		}
+
+		ob.WriteByte(src[i+1])
+		i += 2
+	}
+}
+
+// '&' escaped when it doesn't belong to an entity
+// valid entities are assumed to be anything matching &#?[A-Za-z0-9]+;
+func entity(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	data = data[offset:]
+
+	end := 1
+
+	if end < len(data) && data[end] == '#' {
+		end++
+	}
+
+	for end < len(data) && isalnum(data[end]) {
+		end++
+	}
+
+	if end < len(data) && data[end] == ';' {
+		end++ // real entity
+	} else {
+		return 0 // lone '&'
+	}
+
+	p.r.Entity(out, data[:end])
+
+	return end
+}
+
+func linkEndsWithEntity(data []byte, linkEnd int) bool {
+	entityRanges := htmlEntity.FindAllIndex(data[:linkEnd], -1)
+	if entityRanges != nil && entityRanges[len(entityRanges)-1][1] == linkEnd {
+		return true
+	}
+	return false
+}
+
+func autoLink(p *parser, out *bytes.Buffer, data []byte, offset int) int {
+	// quick check to rule out most false hits on ':'
+	if p.insideLink || len(data) < offset+3 || data[offset+1] != '/' || data[offset+2] != '/' {
+		return 0
+	}
+
+	// Now a more expensive check to see if we're not inside an anchor element
+	anchorStart := offset
+	offsetFromAnchor := 0
+	for anchorStart > 0 && data[anchorStart] != '<' {
+		anchorStart--
+		offsetFromAnchor++
+	}
+
+	anchorStr := anchorRe.Find(data[anchorStart:])
+	if anchorStr != nil {
+		out.Write(anchorStr[offsetFromAnchor:])
+		return len(anchorStr) - offsetFromAnchor
+	}
+
+	// scan backward for a word boundary
+	rewind := 0
+	for offset-rewind > 0 && rewind <= 7 && isletter(data[offset-rewind-1]) {
+		rewind++
+	}
+	if rewind > 6 { // longest supported protocol is "mailto" which has 6 letters
+		return 0
+	}
+
+	origData := data
+	data = data[offset-rewind:]
+
+	if !isSafeLink(data) {
+		return 0
+	}
+
+	linkEnd := 0
+	for linkEnd < len(data) && !isEndOfLink(data[linkEnd]) {
+		linkEnd++
+	}
+
+	// Skip punctuation at the end of the link
+	if (data[linkEnd-1] == '.' || data[linkEnd-1] == ',') && data[linkEnd-2] != '\\' {
+		linkEnd--
+	}
+
+	// But don't skip semicolon if it's a part of escaped entity:
+	if data[linkEnd-1] == ';' && data[linkEnd-2] != '\\' && !linkEndsWithEntity(data, linkEnd) {
+		linkEnd--
+	}
+
+	// See if the link finishes with a punctuation sign that can be closed.
+	var copen byte
+	switch data[linkEnd-1] {
+	case '"':
+		copen = '"'
+	case '\'':
+		copen = '\''
+	case ')':
+		copen = '('
+	case ']':
+		copen = '['
+	case '}':
+		copen = '{'
+	default:
+		copen = 0
+	}
+
+	if copen != 0 {
+		bufEnd := offset - rewind + linkEnd - 2
+
+		openDelim := 1
+
+		/* Try to close the final punctuation sign in this same line;
+		 * if we managed to close it outside of the URL, that means that it's
+		 * not part of the URL. If it closes inside the URL, that means it
+		 * is part of the URL.
+		 *
+		 * Examples:
+		 *
+		 *      foo http://www.pokemon.com/Pikachu_(Electric) bar
+		 *              => http://www.pokemon.com/Pikachu_(Electric)
+		 *
+		 *      foo (http://www.pokemon.com/Pikachu_(Electric)) bar
+		 *              => http://www.pokemon.com/Pikachu_(Electric)
+		 *
+		 *      foo http://www.pokemon.com/Pikachu_(Electric)) bar
+		 *              => http://www.pokemon.com/Pikachu_(Electric))
+		 *
+		 *      (foo http://www.pokemon.com/Pikachu_(Electric)) bar
+		 *              => foo http://www.pokemon.com/Pikachu_(Electric)
+		 */
+
+		for bufEnd >= 0 && origData[bufEnd] != '\n' && openDelim != 0 {
+			if origData[bufEnd] == data[linkEnd-1] {
+				openDelim++
+			}
+
+			if origData[bufEnd] == copen {
+				openDelim--
+			}
+
+			bufEnd--
+		}
+
+		if openDelim == 0 {
+			linkEnd--
+		}
+	}
+
+	// we were triggered on the ':', so we need to rewind the output a bit
+	if out.Len() >= rewind {
+		out.Truncate(len(out.Bytes()) - rewind)
+	}
+
+	var uLink bytes.Buffer
+	unescapeText(&uLink, data[:linkEnd])
+
+	if uLink.Len() > 0 {
+		p.r.AutoLink(out, uLink.Bytes(), LINK_TYPE_NORMAL)
+	}
+
+	return linkEnd - rewind
+}
+
+func isEndOfLink(char byte) bool {
+	return isspace(char) || char == '<'
+}
+
+var validUris = [][]byte{[]byte("http://"), []byte("https://"), []byte("ftp://"), []byte("mailto://")}
+var validPaths = [][]byte{[]byte("/"), []byte("./"), []byte("../")}
+
+func isSafeLink(link []byte) bool {
+	for _, path := range validPaths {
+		if len(link) >= len(path) && bytes.Equal(link[:len(path)], path) {
+			if len(link) == len(path) {
+				return true
+			} else if isalnum(link[len(path)]) {
+				return true
+			}
+		}
+	}
+
+	for _, prefix := range validUris {
+		// TODO: handle unicode here
+		// case-insensitive prefix test
+		if len(link) > len(prefix) && bytes.Equal(bytes.ToLower(link[:len(prefix)]), prefix) && isalnum(link[len(prefix)]) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// return the length of the given tag, or 0 is it's not valid
+func tagLength(data []byte, autolink *int) int {
+	var i, j int
+
+	// a valid tag can't be shorter than 3 chars
+	if len(data) < 3 {
+		return 0
+	}
+
+	// begins with a '<' optionally followed by '/', followed by letter or number
+	if data[0] != '<' {
+		return 0
+	}
+	if data[1] == '/' {
+		i = 2
+	} else {
+		i = 1
+	}
+
+	if !isalnum(data[i]) {
+		return 0
+	}
+
+	// scheme test
+	*autolink = LINK_TYPE_NOT_AUTOLINK
+
+	// try to find the beginning of an URI
+	for i < len(data) && (isalnum(data[i]) || data[i] == '.' || data[i] == '+' || data[i] == '-') {
+		i++
+	}
+
+	if i > 1 && i < len(data) && data[i] == '@' {
+		if j = isMailtoAutoLink(data[i:]); j != 0 {
+			*autolink = LINK_TYPE_EMAIL
+			return i + j
+		}
+	}
+
+	if i > 2 && i < len(data) && data[i] == ':' {
+		*autolink = LINK_TYPE_NORMAL
+		i++
+	}
+
+	// complete autolink test: no whitespace or ' or "
+	switch {
+	case i >= len(data):
+		*autolink = LINK_TYPE_NOT_AUTOLINK
+	case *autolink != 0:
+		j = i
+
+		for i < len(data) {
+			if data[i] == '\\' {
+				i += 2
+			} else if data[i] == '>' || data[i] == '\'' || data[i] == '"' || isspace(data[i]) {
+				break
+			} else {
+				i++
+			}
+
+		}
+
+		if i >= len(data) {
+			return 0
+		}
+		if i > j && data[i] == '>' {
+			return i + 1
+		}
+
+		// one of the forbidden chars has been found
+		*autolink = LINK_TYPE_NOT_AUTOLINK
+	}
+
+	// look for something looking like a tag end
+	for i < len(data) && data[i] != '>' {
+		i++
+	}
+	if i >= len(data) {
+		return 0
+	}
+	return i + 1
+}
+
+// look for the address part of a mail autolink and '>'
+// this is less strict than the original markdown e-mail address matching
+func isMailtoAutoLink(data []byte) int {
+	nb := 0
+
+	// address is assumed to be: [-@._a-zA-Z0-9]+ with exactly one '@'
+	for i := 0; i < len(data); i++ {
+		if isalnum(data[i]) {
+			continue
+		}
+
+		switch data[i] {
+		case '@':
+			nb++
+
+		case '-', '.', '_':
+			break
+
+		case '>':
+			if nb == 1 {
+				return i + 1
+			} else {
+				return 0
+			}
+		default:
+			return 0
+		}
+	}
+
+	return 0
+}
+
+// look for the next emph char, skipping other constructs
+func helperFindEmphChar(data []byte, c byte) int {
+	i := 1
+
+	for i < len(data) {
+		for i < len(data) && data[i] != c && data[i] != '`' && data[i] != '[' {
+			i++
+		}
+		if i >= len(data) {
+			return 0
+		}
+		if data[i] == c {
+			return i
+		}
+
+		// do not count escaped chars
+		if i != 0 && data[i-1] == '\\' {
+			i++
+			continue
+		}
+
+		if data[i] == '`' {
+			// skip a code span
+			tmpI := 0
+			i++
+			for i < len(data) && data[i] != '`' {
+				if tmpI == 0 && data[i] == c {
+					tmpI = i
+				}
+				i++
+			}
+			if i >= len(data) {
+				return tmpI
+			}
+			i++
+		} else if data[i] == '[' {
+			// skip a link
+			tmpI := 0
+			i++
+			for i < len(data) && data[i] != ']' {
+				if tmpI == 0 && data[i] == c {
+					tmpI = i
+				}
+				i++
+			}
+			i++
+			for i < len(data) && (data[i] == ' ' || data[i] == '\n') {
+				i++
+			}
+			if i >= len(data) {
+				return tmpI
+			}
+			if data[i] != '[' && data[i] != '(' { // not a link
+				if tmpI > 0 {
+					return tmpI
+				} else {
+					continue
+				}
+			}
+			cc := data[i]
+			i++
+			for i < len(data) && data[i] != cc {
+				if tmpI == 0 && data[i] == c {
+					return i
+				}
+				i++
+			}
+			if i >= len(data) {
+				return tmpI
+			}
+			i++
+		}
+	}
+	return 0
+}
+
+func helperEmphasis(p *parser, out *bytes.Buffer, data []byte, c byte) int {
+	i := 0
+
+	// skip one symbol if coming from emph3
+	if len(data) > 1 && data[0] == c && data[1] == c {
+		i = 1
+	}
+
+	for i < len(data) {
+		length := helperFindEmphChar(data[i:], c)
+		if length == 0 {
+			return 0
+		}
+		i += length
+		if i >= len(data) {
+			return 0
+		}
+
+		if i+1 < len(data) && data[i+1] == c {
+			i++
+			continue
+		}
+
+		if data[i] == c && !isspace(data[i-1]) {
+
+			if p.flags&EXTENSION_NO_INTRA_EMPHASIS != 0 {
+				if !(i+1 == len(data) || isspace(data[i+1]) || ispunct(data[i+1])) {
+					continue
+				}
+			}
+
+			var work bytes.Buffer
+			p.inline(&work, data[:i])
+			p.r.Emphasis(out, work.Bytes())
+			return i + 1
+		}
+	}
+
+	return 0
+}
+
+func helperDoubleEmphasis(p *parser, out *bytes.Buffer, data []byte, c byte) int {
+	i := 0
+
+	for i < len(data) {
+		length := helperFindEmphChar(data[i:], c)
+		if length == 0 {
+			return 0
+		}
+		i += length
+
+		if i+1 < len(data) && data[i] == c && data[i+1] == c && i > 0 && !isspace(data[i-1]) {
+			var work bytes.Buffer
+			p.inline(&work, data[:i])
+
+			if work.Len() > 0 {
+				// pick the right renderer
+				if c == '~' {
+					p.r.StrikeThrough(out, work.Bytes())
+				} else {
+					p.r.DoubleEmphasis(out, work.Bytes())
+				}
+			}
+			return i + 2
+		}
+		i++
+	}
+	return 0
+}
+
+func helperTripleEmphasis(p *parser, out *bytes.Buffer, data []byte, offset int, c byte) int {
+	i := 0
+	origData := data
+	data = data[offset:]
+
+	for i < len(data) {
+		length := helperFindEmphChar(data[i:], c)
+		if length == 0 {
+			return 0
+		}
+		i += length
+
+		// skip whitespace preceded symbols
+		if data[i] != c || isspace(data[i-1]) {
+			continue
+		}
+
+		switch {
+		case i+2 < len(data) && data[i+1] == c && data[i+2] == c:
+			// triple symbol found
+			var work bytes.Buffer
+
+			p.inline(&work, data[:i])
+			if work.Len() > 0 {
+				p.r.TripleEmphasis(out, work.Bytes())
+			}
+			return i + 3
+		case (i+1 < len(data) && data[i+1] == c):
+			// double symbol found, hand over to emph1
+			length = helperEmphasis(p, out, origData[offset-2:], c)
+			if length == 0 {
+				return 0
+			} else {
+				return length - 2
+			}
+		default:
+			// single symbol found, hand over to emph2
+			length = helperDoubleEmphasis(p, out, origData[offset-1:], c)
+			if length == 0 {
+				return 0
+			} else {
+				return length - 1
+			}
+		}
+	}
+	return 0
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/latex.go b/Godeps/_workspace/src/github.com/russross/blackfriday/latex.go
new file mode 100644
index 0000000000..70705aa9c1
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/latex.go
@@ -0,0 +1,332 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+//
+// LaTeX rendering backend
+//
+//
+
+package blackfriday
+
+import (
+	"bytes"
+)
+
+// Latex is a type that implements the Renderer interface for LaTeX output.
+//
+// Do not create this directly, instead use the LatexRenderer function.
+type Latex struct {
+}
+
+// LatexRenderer creates and configures a Latex object, which
+// satisfies the Renderer interface.
+//
+// flags is a set of LATEX_* options ORed together (currently no such options
+// are defined).
+func LatexRenderer(flags int) Renderer {
+	return &Latex{}
+}
+
+func (options *Latex) GetFlags() int {
+	return 0
+}
+
+// render code chunks using verbatim, or listings if we have a language
+func (options *Latex) BlockCode(out *bytes.Buffer, text []byte, lang string) {
+	if lang == "" {
+		out.WriteString("\n\\begin{verbatim}\n")
+	} else {
+		out.WriteString("\n\\begin{lstlisting}[language=")
+		out.WriteString(lang)
+		out.WriteString("]\n")
+	}
+	out.Write(text)
+	if lang == "" {
+		out.WriteString("\n\\end{verbatim}\n")
+	} else {
+		out.WriteString("\n\\end{lstlisting}\n")
+	}
+}
+
+func (options *Latex) TitleBlock(out *bytes.Buffer, text []byte) {
+
+}
+
+func (options *Latex) BlockQuote(out *bytes.Buffer, text []byte) {
+	out.WriteString("\n\\begin{quotation}\n")
+	out.Write(text)
+	out.WriteString("\n\\end{quotation}\n")
+}
+
+func (options *Latex) BlockHtml(out *bytes.Buffer, text []byte) {
+	// a pretty lame thing to do...
+	out.WriteString("\n\\begin{verbatim}\n")
+	out.Write(text)
+	out.WriteString("\n\\end{verbatim}\n")
+}
+
+func (options *Latex) Header(out *bytes.Buffer, text func() bool, level int, id string) {
+	marker := out.Len()
+
+	switch level {
+	case 1:
+		out.WriteString("\n\\section{")
+	case 2:
+		out.WriteString("\n\\subsection{")
+	case 3:
+		out.WriteString("\n\\subsubsection{")
+	case 4:
+		out.WriteString("\n\\paragraph{")
+	case 5:
+		out.WriteString("\n\\subparagraph{")
+	case 6:
+		out.WriteString("\n\\textbf{")
+	}
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	out.WriteString("}\n")
+}
+
+func (options *Latex) HRule(out *bytes.Buffer) {
+	out.WriteString("\n\\HRule\n")
+}
+
+func (options *Latex) List(out *bytes.Buffer, text func() bool, flags int) {
+	marker := out.Len()
+	if flags&LIST_TYPE_ORDERED != 0 {
+		out.WriteString("\n\\begin{enumerate}\n")
+	} else {
+		out.WriteString("\n\\begin{itemize}\n")
+	}
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	if flags&LIST_TYPE_ORDERED != 0 {
+		out.WriteString("\n\\end{enumerate}\n")
+	} else {
+		out.WriteString("\n\\end{itemize}\n")
+	}
+}
+
+func (options *Latex) ListItem(out *bytes.Buffer, text []byte, flags int) {
+	out.WriteString("\n\\item ")
+	out.Write(text)
+}
+
+func (options *Latex) Paragraph(out *bytes.Buffer, text func() bool) {
+	marker := out.Len()
+	out.WriteString("\n")
+	if !text() {
+		out.Truncate(marker)
+		return
+	}
+	out.WriteString("\n")
+}
+
+func (options *Latex) Table(out *bytes.Buffer, header []byte, body []byte, columnData []int) {
+	out.WriteString("\n\\begin{tabular}{")
+	for _, elt := range columnData {
+		switch elt {
+		case TABLE_ALIGNMENT_LEFT:
+			out.WriteByte('l')
+		case TABLE_ALIGNMENT_RIGHT:
+			out.WriteByte('r')
+		default:
+			out.WriteByte('c')
+		}
+	}
+	out.WriteString("}\n")
+	out.Write(header)
+	out.WriteString(" \\\\\n\\hline\n")
+	out.Write(body)
+	out.WriteString("\n\\end{tabular}\n")
+}
+
+func (options *Latex) TableRow(out *bytes.Buffer, text []byte) {
+	if out.Len() > 0 {
+		out.WriteString(" \\\\\n")
+	}
+	out.Write(text)
+}
+
+func (options *Latex) TableHeaderCell(out *bytes.Buffer, text []byte, align int) {
+	if out.Len() > 0 {
+		out.WriteString(" & ")
+	}
+	out.Write(text)
+}
+
+func (options *Latex) TableCell(out *bytes.Buffer, text []byte, align int) {
+	if out.Len() > 0 {
+		out.WriteString(" & ")
+	}
+	out.Write(text)
+}
+
+// TODO: this
+func (options *Latex) Footnotes(out *bytes.Buffer, text func() bool) {
+
+}
+
+func (options *Latex) FootnoteItem(out *bytes.Buffer, name, text []byte, flags int) {
+
+}
+
+func (options *Latex) AutoLink(out *bytes.Buffer, link []byte, kind int) {
+	out.WriteString("\\href{")
+	if kind == LINK_TYPE_EMAIL {
+		out.WriteString("mailto:")
+	}
+	out.Write(link)
+	out.WriteString("}{")
+	out.Write(link)
+	out.WriteString("}")
+}
+
+func (options *Latex) CodeSpan(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\texttt{")
+	escapeSpecialChars(out, text)
+	out.WriteString("}")
+}
+
+func (options *Latex) DoubleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\textbf{")
+	out.Write(text)
+	out.WriteString("}")
+}
+
+func (options *Latex) Emphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\textit{")
+	out.Write(text)
+	out.WriteString("}")
+}
+
+func (options *Latex) Image(out *bytes.Buffer, link []byte, title []byte, alt []byte) {
+	if bytes.HasPrefix(link, []byte("http://")) || bytes.HasPrefix(link, []byte("https://")) {
+		// treat it like a link
+		out.WriteString("\\href{")
+		out.Write(link)
+		out.WriteString("}{")
+		out.Write(alt)
+		out.WriteString("}")
+	} else {
+		out.WriteString("\\includegraphics{")
+		out.Write(link)
+		out.WriteString("}")
+	}
+}
+
+func (options *Latex) LineBreak(out *bytes.Buffer) {
+	out.WriteString(" \\\\\n")
+}
+
+func (options *Latex) Link(out *bytes.Buffer, link []byte, title []byte, content []byte) {
+	out.WriteString("\\href{")
+	out.Write(link)
+	out.WriteString("}{")
+	out.Write(content)
+	out.WriteString("}")
+}
+
+func (options *Latex) RawHtmlTag(out *bytes.Buffer, tag []byte) {
+}
+
+func (options *Latex) TripleEmphasis(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\textbf{\\textit{")
+	out.Write(text)
+	out.WriteString("}}")
+}
+
+func (options *Latex) StrikeThrough(out *bytes.Buffer, text []byte) {
+	out.WriteString("\\sout{")
+	out.Write(text)
+	out.WriteString("}")
+}
+
+// TODO: this
+func (options *Latex) FootnoteRef(out *bytes.Buffer, ref []byte, id int) {
+
+}
+
+func needsBackslash(c byte) bool {
+	for _, r := range []byte("_{}%$&\\~#") {
+		if c == r {
+			return true
+		}
+	}
+	return false
+}
+
+func escapeSpecialChars(out *bytes.Buffer, text []byte) {
+	for i := 0; i < len(text); i++ {
+		// directly copy normal characters
+		org := i
+
+		for i < len(text) && !needsBackslash(text[i]) {
+			i++
+		}
+		if i > org {
+			out.Write(text[org:i])
+		}
+
+		// escape a character
+		if i >= len(text) {
+			break
+		}
+		out.WriteByte('\\')
+		out.WriteByte(text[i])
+	}
+}
+
+func (options *Latex) Entity(out *bytes.Buffer, entity []byte) {
+	// TODO: convert this into a unicode character or something
+	out.Write(entity)
+}
+
+func (options *Latex) NormalText(out *bytes.Buffer, text []byte) {
+	escapeSpecialChars(out, text)
+}
+
+// header and footer
+func (options *Latex) DocumentHeader(out *bytes.Buffer) {
+	out.WriteString("\\documentclass{article}\n")
+	out.WriteString("\n")
+	out.WriteString("\\usepackage{graphicx}\n")
+	out.WriteString("\\usepackage{listings}\n")
+	out.WriteString("\\usepackage[margin=1in]{geometry}\n")
+	out.WriteString("\\usepackage[utf8]{inputenc}\n")
+	out.WriteString("\\usepackage{verbatim}\n")
+	out.WriteString("\\usepackage[normalem]{ulem}\n")
+	out.WriteString("\\usepackage{hyperref}\n")
+	out.WriteString("\n")
+	out.WriteString("\\hypersetup{colorlinks,%\n")
+	out.WriteString("  citecolor=black,%\n")
+	out.WriteString("  filecolor=black,%\n")
+	out.WriteString("  linkcolor=black,%\n")
+	out.WriteString("  urlcolor=black,%\n")
+	out.WriteString("  pdfstartview=FitH,%\n")
+	out.WriteString("  breaklinks=true,%\n")
+	out.WriteString("  pdfauthor={Blackfriday Markdown Processor v")
+	out.WriteString(VERSION)
+	out.WriteString("}}\n")
+	out.WriteString("\n")
+	out.WriteString("\\newcommand{\\HRule}{\\rule{\\linewidth}{0.5mm}}\n")
+	out.WriteString("\\addtolength{\\parskip}{0.5\\baselineskip}\n")
+	out.WriteString("\\parindent=0pt\n")
+	out.WriteString("\n")
+	out.WriteString("\\begin{document}\n")
+}
+
+func (options *Latex) DocumentFooter(out *bytes.Buffer) {
+	out.WriteString("\n\\end{document}\n")
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/markdown.go b/Godeps/_workspace/src/github.com/russross/blackfriday/markdown.go
new file mode 100644
index 0000000000..c61b006db9
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/markdown.go
@@ -0,0 +1,919 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+//
+// Markdown parsing and processing
+//
+//
+
+// Blackfriday markdown processor.
+//
+// Translates plain text with simple formatting rules into HTML or LaTeX.
+package blackfriday
+
+import (
+	"bytes"
+	"strings"
+	"unicode/utf8"
+)
+
+const VERSION = "1.1"
+
+// These are the supported markdown parsing extensions.
+// OR these values together to select multiple extensions.
+const (
+	EXTENSION_NO_INTRA_EMPHASIS          = 1 << iota // ignore emphasis markers inside words
+	EXTENSION_TABLES                                 // render tables
+	EXTENSION_FENCED_CODE                            // render fenced code blocks
+	EXTENSION_AUTOLINK                               // detect embedded URLs that are not explicitly marked
+	EXTENSION_STRIKETHROUGH                          // strikethrough text using ~~test~~
+	EXTENSION_LAX_HTML_BLOCKS                        // loosen up HTML block parsing rules
+	EXTENSION_SPACE_HEADERS                          // be strict about prefix header rules
+	EXTENSION_HARD_LINE_BREAK                        // translate newlines into line breaks
+	EXTENSION_TAB_SIZE_EIGHT                         // expand tabs to eight spaces instead of four
+	EXTENSION_FOOTNOTES                              // Pandoc-style footnotes
+	EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK             // No need to insert an empty line to start a (code, quote, ordered list, unordered list) block
+	EXTENSION_HEADER_IDS                             // specify header IDs  with {#id}
+	EXTENSION_TITLEBLOCK                             // Titleblock ala pandoc
+	EXTENSION_AUTO_HEADER_IDS                        // Create the header ID from the text
+	EXTENSION_BACKSLASH_LINE_BREAK                   // translate trailing backslashes into line breaks
+	EXTENSION_DEFINITION_LISTS                       // render definition lists
+
+	commonHtmlFlags = 0 |
+		HTML_USE_XHTML |
+		HTML_USE_SMARTYPANTS |
+		HTML_SMARTYPANTS_FRACTIONS |
+		HTML_SMARTYPANTS_LATEX_DASHES
+
+	commonExtensions = 0 |
+		EXTENSION_NO_INTRA_EMPHASIS |
+		EXTENSION_TABLES |
+		EXTENSION_FENCED_CODE |
+		EXTENSION_AUTOLINK |
+		EXTENSION_STRIKETHROUGH |
+		EXTENSION_SPACE_HEADERS |
+		EXTENSION_HEADER_IDS |
+		EXTENSION_BACKSLASH_LINE_BREAK |
+		EXTENSION_DEFINITION_LISTS
+)
+
+// These are the possible flag values for the link renderer.
+// Only a single one of these values will be used; they are not ORed together.
+// These are mostly of interest if you are writing a new output format.
+const (
+	LINK_TYPE_NOT_AUTOLINK = iota
+	LINK_TYPE_NORMAL
+	LINK_TYPE_EMAIL
+)
+
+// These are the possible flag values for the ListItem renderer.
+// Multiple flag values may be ORed together.
+// These are mostly of interest if you are writing a new output format.
+const (
+	LIST_TYPE_ORDERED = 1 << iota
+	LIST_TYPE_DEFINITION
+	LIST_TYPE_TERM
+	LIST_ITEM_CONTAINS_BLOCK
+	LIST_ITEM_BEGINNING_OF_LIST
+	LIST_ITEM_END_OF_LIST
+)
+
+// These are the possible flag values for the table cell renderer.
+// Only a single one of these values will be used; they are not ORed together.
+// These are mostly of interest if you are writing a new output format.
+const (
+	TABLE_ALIGNMENT_LEFT = 1 << iota
+	TABLE_ALIGNMENT_RIGHT
+	TABLE_ALIGNMENT_CENTER = (TABLE_ALIGNMENT_LEFT | TABLE_ALIGNMENT_RIGHT)
+)
+
+// The size of a tab stop.
+const (
+	TAB_SIZE_DEFAULT = 4
+	TAB_SIZE_EIGHT   = 8
+)
+
+// These are the tags that are recognized as HTML block tags.
+// Any of these can be included in markdown text without special escaping.
+var blockTags = map[string]bool{
+	"p":          true,
+	"dl":         true,
+	"h1":         true,
+	"h2":         true,
+	"h3":         true,
+	"h4":         true,
+	"h5":         true,
+	"h6":         true,
+	"ol":         true,
+	"ul":         true,
+	"del":        true,
+	"div":        true,
+	"ins":        true,
+	"pre":        true,
+	"form":       true,
+	"math":       true,
+	"table":      true,
+	"iframe":     true,
+	"script":     true,
+	"fieldset":   true,
+	"noscript":   true,
+	"blockquote": true,
+
+	// HTML5
+	"video":      true,
+	"aside":      true,
+	"canvas":     true,
+	"figure":     true,
+	"footer":     true,
+	"header":     true,
+	"hgroup":     true,
+	"output":     true,
+	"article":    true,
+	"section":    true,
+	"progress":   true,
+	"figcaption": true,
+}
+
+// Renderer is the rendering interface.
+// This is mostly of interest if you are implementing a new rendering format.
+//
+// When a byte slice is provided, it contains the (rendered) contents of the
+// element.
+//
+// When a callback is provided instead, it will write the contents of the
+// respective element directly to the output buffer and return true on success.
+// If the callback returns false, the rendering function should reset the
+// output buffer as though it had never been called.
+//
+// Currently Html and Latex implementations are provided
+type Renderer interface {
+	// block-level callbacks
+	BlockCode(out *bytes.Buffer, text []byte, lang string)
+	BlockQuote(out *bytes.Buffer, text []byte)
+	BlockHtml(out *bytes.Buffer, text []byte)
+	Header(out *bytes.Buffer, text func() bool, level int, id string)
+	HRule(out *bytes.Buffer)
+	List(out *bytes.Buffer, text func() bool, flags int)
+	ListItem(out *bytes.Buffer, text []byte, flags int)
+	Paragraph(out *bytes.Buffer, text func() bool)
+	Table(out *bytes.Buffer, header []byte, body []byte, columnData []int)
+	TableRow(out *bytes.Buffer, text []byte)
+	TableHeaderCell(out *bytes.Buffer, text []byte, flags int)
+	TableCell(out *bytes.Buffer, text []byte, flags int)
+	Footnotes(out *bytes.Buffer, text func() bool)
+	FootnoteItem(out *bytes.Buffer, name, text []byte, flags int)
+	TitleBlock(out *bytes.Buffer, text []byte)
+
+	// Span-level callbacks
+	AutoLink(out *bytes.Buffer, link []byte, kind int)
+	CodeSpan(out *bytes.Buffer, text []byte)
+	DoubleEmphasis(out *bytes.Buffer, text []byte)
+	Emphasis(out *bytes.Buffer, text []byte)
+	Image(out *bytes.Buffer, link []byte, title []byte, alt []byte)
+	LineBreak(out *bytes.Buffer)
+	Link(out *bytes.Buffer, link []byte, title []byte, content []byte)
+	RawHtmlTag(out *bytes.Buffer, tag []byte)
+	TripleEmphasis(out *bytes.Buffer, text []byte)
+	StrikeThrough(out *bytes.Buffer, text []byte)
+	FootnoteRef(out *bytes.Buffer, ref []byte, id int)
+
+	// Low-level callbacks
+	Entity(out *bytes.Buffer, entity []byte)
+	NormalText(out *bytes.Buffer, text []byte)
+
+	// Header and footer
+	DocumentHeader(out *bytes.Buffer)
+	DocumentFooter(out *bytes.Buffer)
+
+	GetFlags() int
+}
+
+// Callback functions for inline parsing. One such function is defined
+// for each character that triggers a response when parsing inline data.
+type inlineParser func(p *parser, out *bytes.Buffer, data []byte, offset int) int
+
+// Parser holds runtime state used by the parser.
+// This is constructed by the Markdown function.
+type parser struct {
+	r              Renderer
+	refOverride    ReferenceOverrideFunc
+	refs           map[string]*reference
+	inlineCallback [256]inlineParser
+	flags          int
+	nesting        int
+	maxNesting     int
+	insideLink     bool
+
+	// Footnotes need to be ordered as well as available to quickly check for
+	// presence. If a ref is also a footnote, it's stored both in refs and here
+	// in notes. Slice is nil if footnotes not enabled.
+	notes []*reference
+}
+
+func (p *parser) getRef(refid string) (ref *reference, found bool) {
+	if p.refOverride != nil {
+		r, overridden := p.refOverride(refid)
+		if overridden {
+			if r == nil {
+				return nil, false
+			}
+			return &reference{
+				link:     []byte(r.Link),
+				title:    []byte(r.Title),
+				noteId:   0,
+				hasBlock: false,
+				text:     []byte(r.Text)}, true
+		}
+	}
+	// refs are case insensitive
+	ref, found = p.refs[strings.ToLower(refid)]
+	return ref, found
+}
+
+//
+//
+// Public interface
+//
+//
+
+// Reference represents the details of a link.
+// See the documentation in Options for more details on use-case.
+type Reference struct {
+	// Link is usually the URL the reference points to.
+	Link string
+	// Title is the alternate text describing the link in more detail.
+	Title string
+	// Text is the optional text to override the ref with if the syntax used was
+	// [refid][]
+	Text string
+}
+
+// ReferenceOverrideFunc is expected to be called with a reference string and
+// return either a valid Reference type that the reference string maps to or
+// nil. If overridden is false, the default reference logic will be executed.
+// See the documentation in Options for more details on use-case.
+type ReferenceOverrideFunc func(reference string) (ref *Reference, overridden bool)
+
+// Options represents configurable overrides and callbacks (in addition to the
+// extension flag set) for configuring a Markdown parse.
+type Options struct {
+	// Extensions is a flag set of bit-wise ORed extension bits. See the
+	// EXTENSION_* flags defined in this package.
+	Extensions int
+
+	// ReferenceOverride is an optional function callback that is called every
+	// time a reference is resolved.
+	//
+	// In Markdown, the link reference syntax can be made to resolve a link to
+	// a reference instead of an inline URL, in one of the following ways:
+	//
+	//  * [link text][refid]
+	//  * [refid][]
+	//
+	// Usually, the refid is defined at the bottom of the Markdown document. If
+	// this override function is provided, the refid is passed to the override
+	// function first, before consulting the defined refids at the bottom. If
+	// the override function indicates an override did not occur, the refids at
+	// the bottom will be used to fill in the link details.
+	ReferenceOverride ReferenceOverrideFunc
+}
+
+// MarkdownBasic is a convenience function for simple rendering.
+// It processes markdown input with no extensions enabled.
+func MarkdownBasic(input []byte) []byte {
+	// set up the HTML renderer
+	htmlFlags := HTML_USE_XHTML
+	renderer := HtmlRenderer(htmlFlags, "", "")
+
+	// set up the parser
+	return MarkdownOptions(input, renderer, Options{Extensions: 0})
+}
+
+// Call Markdown with most useful extensions enabled
+// MarkdownCommon is a convenience function for simple rendering.
+// It processes markdown input with common extensions enabled, including:
+//
+// * Smartypants processing with smart fractions and LaTeX dashes
+//
+// * Intra-word emphasis suppression
+//
+// * Tables
+//
+// * Fenced code blocks
+//
+// * Autolinking
+//
+// * Strikethrough support
+//
+// * Strict header parsing
+//
+// * Custom Header IDs
+func MarkdownCommon(input []byte) []byte {
+	// set up the HTML renderer
+	renderer := HtmlRenderer(commonHtmlFlags, "", "")
+	return MarkdownOptions(input, renderer, Options{
+		Extensions: commonExtensions})
+}
+
+// Markdown is the main rendering function.
+// It parses and renders a block of markdown-encoded text.
+// The supplied Renderer is used to format the output, and extensions dictates
+// which non-standard extensions are enabled.
+//
+// To use the supplied Html or LaTeX renderers, see HtmlRenderer and
+// LatexRenderer, respectively.
+func Markdown(input []byte, renderer Renderer, extensions int) []byte {
+	return MarkdownOptions(input, renderer, Options{
+		Extensions: extensions})
+}
+
+// MarkdownOptions is just like Markdown but takes additional options through
+// the Options struct.
+func MarkdownOptions(input []byte, renderer Renderer, opts Options) []byte {
+	// no point in parsing if we can't render
+	if renderer == nil {
+		return nil
+	}
+
+	extensions := opts.Extensions
+
+	// fill in the render structure
+	p := new(parser)
+	p.r = renderer
+	p.flags = extensions
+	p.refOverride = opts.ReferenceOverride
+	p.refs = make(map[string]*reference)
+	p.maxNesting = 16
+	p.insideLink = false
+
+	// register inline parsers
+	p.inlineCallback['*'] = emphasis
+	p.inlineCallback['_'] = emphasis
+	if extensions&EXTENSION_STRIKETHROUGH != 0 {
+		p.inlineCallback['~'] = emphasis
+	}
+	p.inlineCallback['`'] = codeSpan
+	p.inlineCallback['\n'] = lineBreak
+	p.inlineCallback['['] = link
+	p.inlineCallback['<'] = leftAngle
+	p.inlineCallback['\\'] = escape
+	p.inlineCallback['&'] = entity
+
+	if extensions&EXTENSION_AUTOLINK != 0 {
+		p.inlineCallback[':'] = autoLink
+	}
+
+	if extensions&EXTENSION_FOOTNOTES != 0 {
+		p.notes = make([]*reference, 0)
+	}
+
+	first := firstPass(p, input)
+	second := secondPass(p, first)
+	return second
+}
+
+// first pass:
+// - extract references
+// - expand tabs
+// - normalize newlines
+// - copy everything else
+// - add missing newlines before fenced code blocks
+func firstPass(p *parser, input []byte) []byte {
+	var out bytes.Buffer
+	tabSize := TAB_SIZE_DEFAULT
+	if p.flags&EXTENSION_TAB_SIZE_EIGHT != 0 {
+		tabSize = TAB_SIZE_EIGHT
+	}
+	beg, end := 0, 0
+	lastLineWasBlank := false
+	lastFencedCodeBlockEnd := 0
+	for beg < len(input) { // iterate over lines
+		if end = isReference(p, input[beg:], tabSize); end > 0 {
+			beg += end
+		} else { // skip to the next line
+			end = beg
+			for end < len(input) && input[end] != '\n' && input[end] != '\r' {
+				end++
+			}
+
+			if p.flags&EXTENSION_FENCED_CODE != 0 {
+				// when last line was none blank and a fenced code block comes after
+				if beg >= lastFencedCodeBlockEnd {
+					if i := p.fencedCode(&out, input[beg:], false); i > 0 {
+						if !lastLineWasBlank {
+							out.WriteByte('\n') // need to inject additional linebreak
+						}
+						lastFencedCodeBlockEnd = beg + i
+					}
+				}
+				lastLineWasBlank = end == beg
+			}
+
+			// add the line body if present
+			if end > beg {
+				if end < lastFencedCodeBlockEnd { // Do not expand tabs while inside fenced code blocks.
+					out.Write(input[beg:end])
+				} else {
+					expandTabs(&out, input[beg:end], tabSize)
+				}
+			}
+			out.WriteByte('\n')
+
+			if end < len(input) && input[end] == '\r' {
+				end++
+			}
+			if end < len(input) && input[end] == '\n' {
+				end++
+			}
+
+			beg = end
+		}
+	}
+
+	// empty input?
+	if out.Len() == 0 {
+		out.WriteByte('\n')
+	}
+
+	return out.Bytes()
+}
+
+// second pass: actual rendering
+func secondPass(p *parser, input []byte) []byte {
+	var output bytes.Buffer
+
+	p.r.DocumentHeader(&output)
+	p.block(&output, input)
+
+	if p.flags&EXTENSION_FOOTNOTES != 0 && len(p.notes) > 0 {
+		p.r.Footnotes(&output, func() bool {
+			flags := LIST_ITEM_BEGINNING_OF_LIST
+			for _, ref := range p.notes {
+				var buf bytes.Buffer
+				if ref.hasBlock {
+					flags |= LIST_ITEM_CONTAINS_BLOCK
+					p.block(&buf, ref.title)
+				} else {
+					p.inline(&buf, ref.title)
+				}
+				p.r.FootnoteItem(&output, ref.link, buf.Bytes(), flags)
+				flags &^= LIST_ITEM_BEGINNING_OF_LIST | LIST_ITEM_CONTAINS_BLOCK
+			}
+
+			return true
+		})
+	}
+
+	p.r.DocumentFooter(&output)
+
+	if p.nesting != 0 {
+		panic("Nesting level did not end at zero")
+	}
+
+	return output.Bytes()
+}
+
+//
+// Link references
+//
+// This section implements support for references that (usually) appear
+// as footnotes in a document, and can be referenced anywhere in the document.
+// The basic format is:
+//
+//    [1]: http://www.google.com/ "Google"
+//    [2]: http://www.github.com/ "Github"
+//
+// Anywhere in the document, the reference can be linked by referring to its
+// label, i.e., 1 and 2 in this example, as in:
+//
+//    This library is hosted on [Github][2], a git hosting site.
+//
+// Actual footnotes as specified in Pandoc and supported by some other Markdown
+// libraries such as php-markdown are also taken care of. They look like this:
+//
+//    This sentence needs a bit of further explanation.[^note]
+//
+//    [^note]: This is the explanation.
+//
+// Footnotes should be placed at the end of the document in an ordered list.
+// Inline footnotes such as:
+//
+//    Inline footnotes^[Not supported.] also exist.
+//
+// are not yet supported.
+
+// References are parsed and stored in this struct.
+type reference struct {
+	link     []byte
+	title    []byte
+	noteId   int // 0 if not a footnote ref
+	hasBlock bool
+	text     []byte
+}
+
+// Check whether or not data starts with a reference link.
+// If so, it is parsed and stored in the list of references
+// (in the render struct).
+// Returns the number of bytes to skip to move past it,
+// or zero if the first line is not a reference.
+func isReference(p *parser, data []byte, tabSize int) int {
+	// up to 3 optional leading spaces
+	if len(data) < 4 {
+		return 0
+	}
+	i := 0
+	for i < 3 && data[i] == ' ' {
+		i++
+	}
+
+	noteId := 0
+
+	// id part: anything but a newline between brackets
+	if data[i] != '[' {
+		return 0
+	}
+	i++
+	if p.flags&EXTENSION_FOOTNOTES != 0 {
+		if i < len(data) && data[i] == '^' {
+			// we can set it to anything here because the proper noteIds will
+			// be assigned later during the second pass. It just has to be != 0
+			noteId = 1
+			i++
+		}
+	}
+	idOffset := i
+	for i < len(data) && data[i] != '\n' && data[i] != '\r' && data[i] != ']' {
+		i++
+	}
+	if i >= len(data) || data[i] != ']' {
+		return 0
+	}
+	idEnd := i
+
+	// spacer: colon (space | tab)* newline? (space | tab)*
+	i++
+	if i >= len(data) || data[i] != ':' {
+		return 0
+	}
+	i++
+	for i < len(data) && (data[i] == ' ' || data[i] == '\t') {
+		i++
+	}
+	if i < len(data) && (data[i] == '\n' || data[i] == '\r') {
+		i++
+		if i < len(data) && data[i] == '\n' && data[i-1] == '\r' {
+			i++
+		}
+	}
+	for i < len(data) && (data[i] == ' ' || data[i] == '\t') {
+		i++
+	}
+	if i >= len(data) {
+		return 0
+	}
+
+	var (
+		linkOffset, linkEnd   int
+		titleOffset, titleEnd int
+		lineEnd               int
+		raw                   []byte
+		hasBlock              bool
+	)
+
+	if p.flags&EXTENSION_FOOTNOTES != 0 && noteId != 0 {
+		linkOffset, linkEnd, raw, hasBlock = scanFootnote(p, data, i, tabSize)
+		lineEnd = linkEnd
+	} else {
+		linkOffset, linkEnd, titleOffset, titleEnd, lineEnd = scanLinkRef(p, data, i)
+	}
+	if lineEnd == 0 {
+		return 0
+	}
+
+	// a valid ref has been found
+
+	ref := &reference{
+		noteId:   noteId,
+		hasBlock: hasBlock,
+	}
+
+	if noteId > 0 {
+		// reusing the link field for the id since footnotes don't have links
+		ref.link = data[idOffset:idEnd]
+		// if footnote, it's not really a title, it's the contained text
+		ref.title = raw
+	} else {
+		ref.link = data[linkOffset:linkEnd]
+		ref.title = data[titleOffset:titleEnd]
+	}
+
+	// id matches are case-insensitive
+	id := string(bytes.ToLower(data[idOffset:idEnd]))
+
+	p.refs[id] = ref
+
+	return lineEnd
+}
+
+func scanLinkRef(p *parser, data []byte, i int) (linkOffset, linkEnd, titleOffset, titleEnd, lineEnd int) {
+	// link: whitespace-free sequence, optionally between angle brackets
+	if data[i] == '<' {
+		i++
+	}
+	linkOffset = i
+	for i < len(data) && data[i] != ' ' && data[i] != '\t' && data[i] != '\n' && data[i] != '\r' {
+		i++
+	}
+	if i == len(data) {
+		return
+	}
+	linkEnd = i
+	if data[linkOffset] == '<' && data[linkEnd-1] == '>' {
+		linkOffset++
+		linkEnd--
+	}
+
+	// optional spacer: (space | tab)* (newline | '\'' | '"' | '(' )
+	for i < len(data) && (data[i] == ' ' || data[i] == '\t') {
+		i++
+	}
+	if i < len(data) && data[i] != '\n' && data[i] != '\r' && data[i] != '\'' && data[i] != '"' && data[i] != '(' {
+		return
+	}
+
+	// compute end-of-line
+	if i >= len(data) || data[i] == '\r' || data[i] == '\n' {
+		lineEnd = i
+	}
+	if i+1 < len(data) && data[i] == '\r' && data[i+1] == '\n' {
+		lineEnd++
+	}
+
+	// optional (space|tab)* spacer after a newline
+	if lineEnd > 0 {
+		i = lineEnd + 1
+		for i < len(data) && (data[i] == ' ' || data[i] == '\t') {
+			i++
+		}
+	}
+
+	// optional title: any non-newline sequence enclosed in '"() alone on its line
+	if i+1 < len(data) && (data[i] == '\'' || data[i] == '"' || data[i] == '(') {
+		i++
+		titleOffset = i
+
+		// look for EOL
+		for i < len(data) && data[i] != '\n' && data[i] != '\r' {
+			i++
+		}
+		if i+1 < len(data) && data[i] == '\n' && data[i+1] == '\r' {
+			titleEnd = i + 1
+		} else {
+			titleEnd = i
+		}
+
+		// step back
+		i--
+		for i > titleOffset && (data[i] == ' ' || data[i] == '\t') {
+			i--
+		}
+		if i > titleOffset && (data[i] == '\'' || data[i] == '"' || data[i] == ')') {
+			lineEnd = titleEnd
+			titleEnd = i
+		}
+	}
+
+	return
+}
+
+// The first bit of this logic is the same as (*parser).listItem, but the rest
+// is much simpler. This function simply finds the entire block and shifts it
+// over by one tab if it is indeed a block (just returns the line if it's not).
+// blockEnd is the end of the section in the input buffer, and contents is the
+// extracted text that was shifted over one tab. It will need to be rendered at
+// the end of the document.
+func scanFootnote(p *parser, data []byte, i, indentSize int) (blockStart, blockEnd int, contents []byte, hasBlock bool) {
+	if i == 0 || len(data) == 0 {
+		return
+	}
+
+	// skip leading whitespace on first line
+	for i < len(data) && data[i] == ' ' {
+		i++
+	}
+
+	blockStart = i
+
+	// find the end of the line
+	blockEnd = i
+	for i < len(data) && data[i-1] != '\n' {
+		i++
+	}
+
+	// get working buffer
+	var raw bytes.Buffer
+
+	// put the first line into the working buffer
+	raw.Write(data[blockEnd:i])
+	blockEnd = i
+
+	// process the following lines
+	containsBlankLine := false
+
+gatherLines:
+	for blockEnd < len(data) {
+		i++
+
+		// find the end of this line
+		for i < len(data) && data[i-1] != '\n' {
+			i++
+		}
+
+		// if it is an empty line, guess that it is part of this item
+		// and move on to the next line
+		if p.isEmpty(data[blockEnd:i]) > 0 {
+			containsBlankLine = true
+			blockEnd = i
+			continue
+		}
+
+		n := 0
+		if n = isIndented(data[blockEnd:i], indentSize); n == 0 {
+			// this is the end of the block.
+			// we don't want to include this last line in the index.
+			break gatherLines
+		}
+
+		// if there were blank lines before this one, insert a new one now
+		if containsBlankLine {
+			raw.WriteByte('\n')
+			containsBlankLine = false
+		}
+
+		// get rid of that first tab, write to buffer
+		raw.Write(data[blockEnd+n : i])
+		hasBlock = true
+
+		blockEnd = i
+	}
+
+	if data[blockEnd-1] != '\n' {
+		raw.WriteByte('\n')
+	}
+
+	contents = raw.Bytes()
+
+	return
+}
+
+//
+//
+// Miscellaneous helper functions
+//
+//
+
+// Test if a character is a punctuation symbol.
+// Taken from a private function in regexp in the stdlib.
+func ispunct(c byte) bool {
+	for _, r := range []byte("!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~") {
+		if c == r {
+			return true
+		}
+	}
+	return false
+}
+
+// Test if a character is a whitespace character.
+func isspace(c byte) bool {
+	return c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == '\f' || c == '\v'
+}
+
+// Test if a character is letter.
+func isletter(c byte) bool {
+	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+}
+
+// Test if a character is a letter or a digit.
+// TODO: check when this is looking for ASCII alnum and when it should use unicode
+func isalnum(c byte) bool {
+	return (c >= '0' && c <= '9') || isletter(c)
+}
+
+// Replace tab characters with spaces, aligning to the next TAB_SIZE column.
+// always ends output with a newline
+func expandTabs(out *bytes.Buffer, line []byte, tabSize int) {
+	// first, check for common cases: no tabs, or only tabs at beginning of line
+	i, prefix := 0, 0
+	slowcase := false
+	for i = 0; i < len(line); i++ {
+		if line[i] == '\t' {
+			if prefix == i {
+				prefix++
+			} else {
+				slowcase = true
+				break
+			}
+		}
+	}
+
+	// no need to decode runes if all tabs are at the beginning of the line
+	if !slowcase {
+		for i = 0; i < prefix*tabSize; i++ {
+			out.WriteByte(' ')
+		}
+		out.Write(line[prefix:])
+		return
+	}
+
+	// the slow case: we need to count runes to figure out how
+	// many spaces to insert for each tab
+	column := 0
+	i = 0
+	for i < len(line) {
+		start := i
+		for i < len(line) && line[i] != '\t' {
+			_, size := utf8.DecodeRune(line[i:])
+			i += size
+			column++
+		}
+
+		if i > start {
+			out.Write(line[start:i])
+		}
+
+		if i >= len(line) {
+			break
+		}
+
+		for {
+			out.WriteByte(' ')
+			column++
+			if column%tabSize == 0 {
+				break
+			}
+		}
+
+		i++
+	}
+}
+
+// Find if a line counts as indented or not.
+// Returns number of characters the indent is (0 = not indented).
+func isIndented(data []byte, indentSize int) int {
+	if len(data) == 0 {
+		return 0
+	}
+	if data[0] == '\t' {
+		return 1
+	}
+	if len(data) < indentSize {
+		return 0
+	}
+	for i := 0; i < indentSize; i++ {
+		if data[i] != ' ' {
+			return 0
+		}
+	}
+	return indentSize
+}
+
+// Create a url-safe slug for fragments
+func slugify(in []byte) []byte {
+	if len(in) == 0 {
+		return in
+	}
+	out := make([]byte, 0, len(in))
+	sym := false
+
+	for _, ch := range in {
+		if isalnum(ch) {
+			sym = false
+			out = append(out, ch)
+		} else if sym {
+			continue
+		} else {
+			out = append(out, '-')
+			sym = true
+		}
+	}
+	var a, b int
+	var ch byte
+	for a, ch = range out {
+		if ch != '-' {
+			break
+		}
+	}
+	for b = len(out) - 1; b > 0; b-- {
+		if out[b] != '-' {
+			break
+		}
+	}
+	return out[a : b+1]
+}
diff --git a/Godeps/_workspace/src/github.com/russross/blackfriday/smartypants.go b/Godeps/_workspace/src/github.com/russross/blackfriday/smartypants.go
new file mode 100644
index 0000000000..8027571df3
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/russross/blackfriday/smartypants.go
@@ -0,0 +1,398 @@
+//
+// Blackfriday Markdown Processor
+// Available at http://github.com/russross/blackfriday
+//
+// Copyright © 2011 Russ Ross <russ@russross.com>.
+// Distributed under the Simplified BSD License.
+// See README.md for details.
+//
+
+//
+//
+// SmartyPants rendering
+//
+//
+
+package blackfriday
+
+import (
+	"bytes"
+)
+
+type smartypantsData struct {
+	inSingleQuote bool
+	inDoubleQuote bool
+}
+
+func wordBoundary(c byte) bool {
+	return c == 0 || isspace(c) || ispunct(c)
+}
+
+func tolower(c byte) byte {
+	if c >= 'A' && c <= 'Z' {
+		return c - 'A' + 'a'
+	}
+	return c
+}
+
+func isdigit(c byte) bool {
+	return c >= '0' && c <= '9'
+}
+
+func smartQuoteHelper(out *bytes.Buffer, previousChar byte, nextChar byte, quote byte, isOpen *bool) bool {
+	// edge of the buffer is likely to be a tag that we don't get to see,
+	// so we treat it like text sometimes
+
+	// enumerate all sixteen possibilities for (previousChar, nextChar)
+	// each can be one of {0, space, punct, other}
+	switch {
+	case previousChar == 0 && nextChar == 0:
+		// context is not any help here, so toggle
+		*isOpen = !*isOpen
+	case isspace(previousChar) && nextChar == 0:
+		// [ "] might be [ "<code>foo...]
+		*isOpen = true
+	case ispunct(previousChar) && nextChar == 0:
+		// [!"] hmm... could be [Run!"] or [("<code>...]
+		*isOpen = false
+	case /* isnormal(previousChar) && */ nextChar == 0:
+		// [a"] is probably a close
+		*isOpen = false
+	case previousChar == 0 && isspace(nextChar):
+		// [" ] might be [...foo</code>" ]
+		*isOpen = false
+	case isspace(previousChar) && isspace(nextChar):
+		// [ " ] context is not any help here, so toggle
+		*isOpen = !*isOpen
+	case ispunct(previousChar) && isspace(nextChar):
+		// [!" ] is probably a close
+		*isOpen = false
+	case /* isnormal(previousChar) && */ isspace(nextChar):
+		// [a" ] this is one of the easy cases
+		*isOpen = false
+	case previousChar == 0 && ispunct(nextChar):
+		// ["!] hmm... could be ["$1.95] or [</code>"!...]
+		*isOpen = false
+	case isspace(previousChar) && ispunct(nextChar):
+		// [ "!] looks more like [ "$1.95]
+		*isOpen = true
+	case ispunct(previousChar) && ispunct(nextChar):
+		// [!"!] context is not any help here, so toggle
+		*isOpen = !*isOpen
+	case /* isnormal(previousChar) && */ ispunct(nextChar):
+		// [a"!] is probably a close
+		*isOpen = false
+	case previousChar == 0 /* && isnormal(nextChar) */ :
+		// ["a] is probably an open
+		*isOpen = true
+	case isspace(previousChar) /* && isnormal(nextChar) */ :
+		// [ "a] this is one of the easy cases
+		*isOpen = true
+	case ispunct(previousChar) /* && isnormal(nextChar) */ :
+		// [!"a] is probably an open
+		*isOpen = true
+	default:
+		// [a'b] maybe a contraction?
+		*isOpen = false
+	}
+
+	out.WriteByte('&')
+	if *isOpen {
+		out.WriteByte('l')
+	} else {
+		out.WriteByte('r')
+	}
+	out.WriteByte(quote)
+	out.WriteString("quo;")
+	return true
+}
+
+func smartSingleQuote(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 2 {
+		t1 := tolower(text[1])
+
+		if t1 == '\'' {
+			nextChar := byte(0)
+			if len(text) >= 3 {
+				nextChar = text[2]
+			}
+			if smartQuoteHelper(out, previousChar, nextChar, 'd', &smrt.inDoubleQuote) {
+				return 1
+			}
+		}
+
+		if (t1 == 's' || t1 == 't' || t1 == 'm' || t1 == 'd') && (len(text) < 3 || wordBoundary(text[2])) {
+			out.WriteString("&rsquo;")
+			return 0
+		}
+
+		if len(text) >= 3 {
+			t2 := tolower(text[2])
+
+			if ((t1 == 'r' && t2 == 'e') || (t1 == 'l' && t2 == 'l') || (t1 == 'v' && t2 == 'e')) &&
+				(len(text) < 4 || wordBoundary(text[3])) {
+				out.WriteString("&rsquo;")
+				return 0
+			}
+		}
+	}
+
+	nextChar := byte(0)
+	if len(text) > 1 {
+		nextChar = text[1]
+	}
+	if smartQuoteHelper(out, previousChar, nextChar, 's', &smrt.inSingleQuote) {
+		return 0
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartParens(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 3 {
+		t1 := tolower(text[1])
+		t2 := tolower(text[2])
+
+		if t1 == 'c' && t2 == ')' {
+			out.WriteString("&copy;")
+			return 2
+		}
+
+		if t1 == 'r' && t2 == ')' {
+			out.WriteString("&reg;")
+			return 2
+		}
+
+		if len(text) >= 4 && t1 == 't' && t2 == 'm' && text[3] == ')' {
+			out.WriteString("&trade;")
+			return 3
+		}
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartDash(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 2 {
+		if text[1] == '-' {
+			out.WriteString("&mdash;")
+			return 1
+		}
+
+		if wordBoundary(previousChar) && wordBoundary(text[1]) {
+			out.WriteString("&ndash;")
+			return 0
+		}
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartDashLatex(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 3 && text[1] == '-' && text[2] == '-' {
+		out.WriteString("&mdash;")
+		return 2
+	}
+	if len(text) >= 2 && text[1] == '-' {
+		out.WriteString("&ndash;")
+		return 1
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartAmpVariant(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte, quote byte) int {
+	if bytes.HasPrefix(text, []byte("&quot;")) {
+		nextChar := byte(0)
+		if len(text) >= 7 {
+			nextChar = text[6]
+		}
+		if smartQuoteHelper(out, previousChar, nextChar, quote, &smrt.inDoubleQuote) {
+			return 5
+		}
+	}
+
+	if bytes.HasPrefix(text, []byte("&#0;")) {
+		return 3
+	}
+
+	out.WriteByte('&')
+	return 0
+}
+
+func smartAmp(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	return smartAmpVariant(out, smrt, previousChar, text, 'd')
+}
+
+func smartAmpAngledQuote(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	return smartAmpVariant(out, smrt, previousChar, text, 'a')
+}
+
+func smartPeriod(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 3 && text[1] == '.' && text[2] == '.' {
+		out.WriteString("&hellip;")
+		return 2
+	}
+
+	if len(text) >= 5 && text[1] == ' ' && text[2] == '.' && text[3] == ' ' && text[4] == '.' {
+		out.WriteString("&hellip;")
+		return 4
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartBacktick(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if len(text) >= 2 && text[1] == '`' {
+		nextChar := byte(0)
+		if len(text) >= 3 {
+			nextChar = text[2]
+		}
+		if smartQuoteHelper(out, previousChar, nextChar, 'd', &smrt.inDoubleQuote) {
+			return 1
+		}
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartNumberGeneric(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if wordBoundary(previousChar) && previousChar != '/' && len(text) >= 3 {
+		// is it of the form digits/digits(word boundary)?, i.e., \d+/\d+\b
+		// note: check for regular slash (/) or fraction slash (⁄, 0x2044, or 0xe2 81 84 in utf-8)
+		//       and avoid changing dates like 1/23/2005 into fractions.
+		numEnd := 0
+		for len(text) > numEnd && isdigit(text[numEnd]) {
+			numEnd++
+		}
+		if numEnd == 0 {
+			out.WriteByte(text[0])
+			return 0
+		}
+		denStart := numEnd + 1
+		if len(text) > numEnd+3 && text[numEnd] == 0xe2 && text[numEnd+1] == 0x81 && text[numEnd+2] == 0x84 {
+			denStart = numEnd + 3
+		} else if len(text) < numEnd+2 || text[numEnd] != '/' {
+			out.WriteByte(text[0])
+			return 0
+		}
+		denEnd := denStart
+		for len(text) > denEnd && isdigit(text[denEnd]) {
+			denEnd++
+		}
+		if denEnd == denStart {
+			out.WriteByte(text[0])
+			return 0
+		}
+		if len(text) == denEnd || wordBoundary(text[denEnd]) && text[denEnd] != '/' {
+			out.WriteString("<sup>")
+			out.Write(text[:numEnd])
+			out.WriteString("</sup>&frasl;<sub>")
+			out.Write(text[denStart:denEnd])
+			out.WriteString("</sub>")
+			return denEnd - 1
+		}
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartNumber(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	if wordBoundary(previousChar) && previousChar != '/' && len(text) >= 3 {
+		if text[0] == '1' && text[1] == '/' && text[2] == '2' {
+			if len(text) < 4 || wordBoundary(text[3]) && text[3] != '/' {
+				out.WriteString("&frac12;")
+				return 2
+			}
+		}
+
+		if text[0] == '1' && text[1] == '/' && text[2] == '4' {
+			if len(text) < 4 || wordBoundary(text[3]) && text[3] != '/' || (len(text) >= 5 && tolower(text[3]) == 't' && tolower(text[4]) == 'h') {
+				out.WriteString("&frac14;")
+				return 2
+			}
+		}
+
+		if text[0] == '3' && text[1] == '/' && text[2] == '4' {
+			if len(text) < 4 || wordBoundary(text[3]) && text[3] != '/' || (len(text) >= 6 && tolower(text[3]) == 't' && tolower(text[4]) == 'h' && tolower(text[5]) == 's') {
+				out.WriteString("&frac34;")
+				return 2
+			}
+		}
+	}
+
+	out.WriteByte(text[0])
+	return 0
+}
+
+func smartDoubleQuoteVariant(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte, quote byte) int {
+	nextChar := byte(0)
+	if len(text) > 1 {
+		nextChar = text[1]
+	}
+	if !smartQuoteHelper(out, previousChar, nextChar, quote, &smrt.inDoubleQuote) {
+		out.WriteString("&quot;")
+	}
+
+	return 0
+}
+
+func smartDoubleQuote(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	return smartDoubleQuoteVariant(out, smrt, previousChar, text, 'd')
+}
+
+func smartAngledDoubleQuote(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	return smartDoubleQuoteVariant(out, smrt, previousChar, text, 'a')
+}
+
+func smartLeftAngle(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int {
+	i := 0
+
+	for i < len(text) && text[i] != '>' {
+		i++
+	}
+
+	out.Write(text[:i+1])
+	return i
+}
+
+type smartCallback func(out *bytes.Buffer, smrt *smartypantsData, previousChar byte, text []byte) int
+
+type smartypantsRenderer [256]smartCallback
+
+func smartypants(flags int) *smartypantsRenderer {
+	r := new(smartypantsRenderer)
+	if flags&HTML_SMARTYPANTS_ANGLED_QUOTES == 0 {
+		r['"'] = smartDoubleQuote
+		r['&'] = smartAmp
+	} else {
+		r['"'] = smartAngledDoubleQuote
+		r['&'] = smartAmpAngledQuote
+	}
+	r['\''] = smartSingleQuote
+	r['('] = smartParens
+	if flags&HTML_SMARTYPANTS_LATEX_DASHES == 0 {
+		r['-'] = smartDash
+	} else {
+		r['-'] = smartDashLatex
+	}
+	r['.'] = smartPeriod
+	if flags&HTML_SMARTYPANTS_FRACTIONS == 0 {
+		r['1'] = smartNumber
+		r['3'] = smartNumber
+	} else {
+		for ch := '1'; ch <= '9'; ch++ {
+			r[ch] = smartNumberGeneric
+		}
+	}
+	r['<'] = smartLeftAngle
+	r['`'] = smartBacktick
+	return r
+}
diff --git a/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/.travis.yml b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/.travis.yml
new file mode 100644
index 0000000000..e2a30338f7
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/.travis.yml
@@ -0,0 +1,10 @@
+language: go
+go:
+  - 1.5
+install:
+  - go get golang.org/x/tools/cmd/vet
+script:
+  - go get -t -v ./...
+  - diff -u <(echo -n) <(gofmt -d ./)
+  - go tool vet ./
+  - go test -v -race ./...
diff --git a/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/README.md b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/README.md
new file mode 100644
index 0000000000..e51c35a8be
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/README.md
@@ -0,0 +1,31 @@
+# sanitized_anchor_name [![Build Status](https://travis-ci.org/shurcooL/sanitized_anchor_name.svg?branch=master)](https://travis-ci.org/shurcooL/sanitized_anchor_name) [![GoDoc](https://godoc.org/github.com/shurcooL/sanitized_anchor_name?status.svg)](https://godoc.org/github.com/shurcooL/sanitized_anchor_name)
+
+Package sanitized_anchor_name provides a func to create sanitized anchor names.
+
+Its logic can be reused by multiple packages to create interoperable anchor names and links to those anchors.
+
+At this time, it does not try to ensure that generated anchor names are unique, that responsibility falls on the caller.
+
+Installation
+------------
+
+```bash
+go get -u github.com/shurcooL/sanitized_anchor_name
+```
+
+Example
+-------
+
+```Go
+anchorName := sanitized_anchor_name.Create("This is a header")
+
+fmt.Println(anchorName)
+
+// Output:
+// this-is-a-header
+```
+
+License
+-------
+
+- [MIT License](http://opensource.org/licenses/mit-license.php)
diff --git a/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/main.go b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/main.go
new file mode 100644
index 0000000000..6baae23b50
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/shurcooL/sanitized_anchor_name/main.go
@@ -0,0 +1,29 @@
+// Package sanitized_anchor_name provides a func to create sanitized anchor names.
+//
+// Its logic can be reused by multiple packages to create interoperable anchor names
+// and links to those anchors.
+//
+// At this time, it does not try to ensure that generated anchor names
+// are unique, that responsibility falls on the caller.
+package sanitized_anchor_name
+
+import "unicode"
+
+// Create returns a sanitized anchor name for the given text.
+func Create(text string) string {
+	var anchorName []rune
+	var futureDash = false
+	for _, r := range []rune(text) {
+		switch {
+		case unicode.IsLetter(r) || unicode.IsNumber(r):
+			if futureDash && len(anchorName) > 0 {
+				anchorName = append(anchorName, '-')
+			}
+			futureDash = false
+			anchorName = append(anchorName, unicode.ToLower(r))
+		default:
+			futureDash = true
+		}
+	}
+	return string(anchorName)
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/.travis.yml b/Godeps/_workspace/src/github.com/spf13/cobra/.travis.yml
index dc43afd61b..60030e9f33 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/.travis.yml
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/.travis.yml
@@ -1,7 +1,8 @@
 language: go
 go:
-  - 1.3
+  - 1.3.3
   - 1.4.2
+  - 1.5.1
   - tip
 script:
   - go test ./...
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/README.md b/Godeps/_workspace/src/github.com/spf13/cobra/README.md
index b1fb0889ec..0b90df7660 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/README.md
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/README.md
@@ -1,19 +1,49 @@
-# Cobra
+![cobra logo](https://cloud.githubusercontent.com/assets/173412/10886352/ad566232-814f-11e5-9cd0-aa101788c117.png)
+
+Cobra is both a library for creating powerful modern CLI applications as well as a program to generate applications and command files. 
+
+Many of the most widely used Go projects are built using Cobra including:
+
+* [Kubernetes](http://kubernetes.io/)
+* [Hugo](http://gohugo.io)
+* [Rocket](https://github.com/coreos/rkt)
+* [Docker (distribution)](https://github.com/docker/distribution) 
+* [OpenShift](https://www.openshift.com/)
+* [Delve](https://github.com/derekparker/delve)
+* [GopherJS](http://www.gopherjs.org/)
+* [CockroachDB](http://www.cockroachlabs.com/)
+* [Bleve](http://www.blevesearch.com/)
+* [ProjectAtomic (enterprise)](http://www.projectatomic.io/)
+* [Parse (CLI)](https://parse.com/)
 
-A Commander for modern go CLI interactions
 
 [![Build Status](https://travis-ci.org/spf13/cobra.svg)](https://travis-ci.org/spf13/cobra)
 
+![cobra](https://cloud.githubusercontent.com/assets/173412/10911369/84832a8e-8212-11e5-9f82-cc96660a4794.gif)
+
 ## Overview
 
-Cobra is a commander providing a simple interface to create powerful modern CLI
-interfaces similar to git & go tools. In addition to providing an interface, Cobra
-simultaneously provides a controller to organize your application code.
+Cobra is a library providing a simple interface to create powerful modern CLI
+interfaces similar to git & go tools.
 
-Inspired by go, go-Commander, gh and subcommand, Cobra improves on these by
-providing **fully posix compliant flags** (including short & long versions),
-**nesting commands**, and the ability to **define your own help and usage** for any or
-all commands.
+Cobra is also an application that will generate your application scaffolding to rapidly
+develop a Cobra based application.
+
+Cobra provides:
+* Easy sub-command based CLIs: `app server`, `app fetch`, etc.
+* Fully posix compliant flags (including short & long versions)
+* Nested sub commands
+* Global, local and cascading flags
+* Easy generation of applications & commands with `cobra create appname` & `cobra add cmdname`
+* Intelligent suggestions (`app srver`.. did you mean `app server`)
+* Automatic help generation for commands and flags
+* Automatic detailed help for `app help [command]`
+* Automatic help flag recognition of `-h`, `--help`, etc.
+* Automatically generated bash autocomplete for your application
+* Automatically generated man pages for your application
+* Command aliases so you can change things without breaking them
+* The flexibilty to define your own help, usage, etc
+* Optional tight integration with [viper](http://github.com/spf13/viper) for 12 factor apps
 
 Cobra has an exceptionally clean interface and simple design without needless
 constructors or initialization methods.
@@ -350,13 +380,13 @@ Like help the function and template are over ridable through public methods.
 
 ## PreRun or PostRun Hooks
 
-It is possible to run functions before or after the main `Run` function of your command. The `PersistentPreRun` and `PreRun` functions will be executed before `Run`. `PersistendPostRun` and `PostRun` will be executed after `Run`.  The `Persistent*Run` functions will be inherrited by children if they do not declare their own.  These function are run in the following order:
+It is possible to run functions before or after the main `Run` function of your command. The `PersistentPreRun` and `PreRun` functions will be executed before `Run`. `PersistentPostRun` and `PostRun` will be executed after `Run`.  The `Persistent*Run` functions will be inherrited by children if they do not declare their own.  These function are run in the following order:
 
 - `PersistentPreRun`
 - `PreRun`
 - `Run`
 - `PostRun`
-- `PersistenPostRun`
+- `PersistentPostRun`
 
 And example of two commands which use all of these features is below.  When the subcommand in executed it will run the root command's `PersistentPreRun` but not the root command's `PersistentPostRun`
 
@@ -418,10 +448,50 @@ func main() {
 }
 ```
 
+## Suggestions when "unknown command" happens
+
+Cobra will print automatic suggestions when "unknown command" errors happen. This allows Cobra to behavior similarly to the `git` command when a typo happens. For example:
+
+```
+$ hugo srever
+unknown command "srever" for "hugo"
+
+Did you mean this?
+  server
+
+Run 'hugo --help' for usage.
+```
+
+Suggestions are automatic based on every subcommand registered and use an implementation of Levenshtein distance. Every registered command that matches a minimum distance of 2 (ignoring case) will be displayed as a suggestion.
+
+If you need to disable suggestions or tweak the string distance in your command, use:
+
+    command.DisableSuggestions = true
+
+or 
+
+    command.SuggestionsMinimumDistance = 1
+
+You can also explicitly set names for which a given command will be suggested using the `SuggestFor` attribute. This allows suggestions for strings that are not close in terms of string distance, but makes sense in your set of commands and for some which you don't want aliases. Example:
+
+```
+$ hugo delete
+unknown command "delete" for "hugo"
+
+Did you mean this?
+  remove
+
+Run 'hugo --help' for usage.
+```
+
 ## Generating markdown formatted documentation for your command
 
 Cobra can generate a markdown formatted document based on the subcommands, flags, etc. A simple example of how to do this for your command can be found in [Markdown Docs](md_docs.md)
 
+## Generating man pages for your command
+
+Cobra can generate a man page based on the subcommands, flags, etc. A simple example of how to do this for your command can be found in [Man Docs](man_docs.md)
+
 ## Generating bash completions for your command
 
 Cobra can generate a bash completions file. If you add more information to your command these completions can be amazingly powerful and flexible.  Read more about [Bash Completions](bash_completions.md)
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions.go b/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions.go
index 735d2f54c5..2cea735b49 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions.go
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions.go
@@ -13,12 +13,12 @@ import (
 const (
 	BashCompFilenameExt     = "cobra_annotation_bash_completion_filename_extentions"
 	BashCompOneRequiredFlag = "cobra_annotation_bash_completion_one_required_flag"
+	BashCompSubdirsInDir    = "cobra_annotation_bash_completion_subdirs_in_dir"
 )
 
 func preamble(out *bytes.Buffer) {
 	fmt.Fprintf(out, `#!/bin/bash
 
-
 __debug()
 {
     if [[ -n ${BASH_COMP_DEBUG_FILE} ]]; then
@@ -26,6 +26,14 @@ __debug()
     fi
 }
 
+# Homebrew on Macs have version 1.3 of bash-completion which doesn't include
+# _init_completion. This is a very minimal version of that function.
+__my_init_completion()
+{
+    COMPREPLY=()
+    _get_comp_words_by_ref cur prev words cword
+}
+
 __index_of_word()
 {
     local w word=$1
@@ -52,7 +60,9 @@ __handle_reply()
     __debug "${FUNCNAME}"
     case $cur in
         -*)
-            compopt -o nospace
+            if builtin compopt > /dev/null 2>&1; then
+              compopt -o nospace
+            fi
             local allflags
             if [ ${#must_have_one_flag[@]} -ne 0 ]; then
                 allflags=("${must_have_one_flag[@]}")
@@ -60,7 +70,9 @@ __handle_reply()
                 allflags=("${flags[*]} ${two_word_flags[*]}")
             fi
             COMPREPLY=( $(compgen -W "${allflags[*]}" -- "$cur") )
-            [[ $COMPREPLY == *= ]] || compopt +o nospace
+            if builtin compopt > /dev/null 2>&1; then
+              [[ $COMPREPLY == *= ]] || compopt +o nospace
+            fi
             return 0;
             ;;
     esac
@@ -100,6 +112,12 @@ __handle_filename_extension_flag()
     _filedir "@(${ext})"
 }
 
+__handle_subdirs_in_dir_flag()
+{
+    local dir="$1"
+    pushd "${dir}" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1
+}
+
 __handle_flag()
 {
     __debug "${FUNCNAME}: c is $c words[c] is ${words[c]}"
@@ -181,7 +199,11 @@ func postscript(out *bytes.Buffer, name string) {
 	fmt.Fprintf(out, "__start_%s()\n", name)
 	fmt.Fprintf(out, `{
     local cur prev words cword
-    _init_completion -s || return
+    if declare -F _init_completion >/dev/null 2>&1; then
+        _init_completion -s || return
+    else
+        __my_init_completion || return
+    fi
 
     local c=0
     local flags=()
@@ -198,14 +220,20 @@ func postscript(out *bytes.Buffer, name string) {
 }
 
 `, name)
-	fmt.Fprintf(out, "complete -F __start_%s %s\n", name, name)
+	fmt.Fprintf(out, `
+		if builtin compopt > /dev/null 2>&1; then
+			complete -F __start_%s %s
+		else
+			complete -o nospace -F __start_%s %s
+		fi
+		`, name, name, name, name)
 	fmt.Fprintf(out, "# ex: ts=4 sw=4 et filetype=sh\n")
 }
 
 func writeCommands(cmd *Command, out *bytes.Buffer) {
 	fmt.Fprintf(out, "    commands=()\n")
 	for _, c := range cmd.Commands() {
-		if len(c.Deprecated) > 0 {
+		if !c.IsAvailableCommand() || c == cmd.helpCommand {
 			continue
 		}
 		fmt.Fprintf(out, "    commands+=(%q)\n", c.Name())
@@ -219,9 +247,23 @@ func writeFlagHandler(name string, annotations map[string][]string, out *bytes.B
 		case BashCompFilenameExt:
 			fmt.Fprintf(out, "    flags_with_completion+=(%q)\n", name)
 
-			ext := strings.Join(value, "|")
-			ext = "__handle_filename_extension_flag " + ext
-			fmt.Fprintf(out, "    flags_completion+=(%q)\n", ext)
+			if len(value) > 0 {
+				ext := "__handle_filename_extension_flag " + strings.Join(value, "|")
+				fmt.Fprintf(out, "    flags_completion+=(%q)\n", ext)
+			} else {
+				ext := "_filedir"
+				fmt.Fprintf(out, "    flags_completion+=(%q)\n", ext)
+			}
+		case BashCompSubdirsInDir:
+			fmt.Fprintf(out, "    flags_with_completion+=(%q)\n", name)
+
+			if len(value) == 1 {
+				ext := "__handle_subdirs_in_dir_flag " + value[0]
+				fmt.Fprintf(out, "    flags_completion+=(%q)\n", ext)
+			} else {
+				ext := "_filedir -d"
+				fmt.Fprintf(out, "    flags_completion+=(%q)\n", ext)
+			}
 		}
 	}
 }
@@ -271,7 +313,7 @@ func writeRequiredFlag(cmd *Command, out *bytes.Buffer) {
 	fmt.Fprintf(out, "    must_have_one_flag=()\n")
 	flags := cmd.NonInheritedFlags()
 	flags.VisitAll(func(flag *pflag.Flag) {
-		for key, _ := range flag.Annotations {
+		for key := range flag.Annotations {
 			switch key {
 			case BashCompOneRequiredFlag:
 				format := "    must_have_one_flag+=(\"--%s"
@@ -300,7 +342,7 @@ func writeRequiredNoun(cmd *Command, out *bytes.Buffer) {
 
 func gen(cmd *Command, out *bytes.Buffer) {
 	for _, c := range cmd.Commands() {
-		if len(c.Deprecated) > 0 {
+		if !c.IsAvailableCommand() || c == cmd.helpCommand {
 			continue
 		}
 		gen(c, out)
@@ -343,15 +385,24 @@ func (cmd *Command) GenBashCompletionFile(filename string) error {
 	return nil
 }
 
-func (cmd *Command) MarkFlagRequired(name string) {
-	flag := cmd.Flags().Lookup(name)
-	if flag == nil {
-		return
-	}
-	if flag.Annotations == nil {
-		flag.Annotations = make(map[string][]string)
-	}
-	annotation := make([]string, 1)
-	annotation[0] = "true"
-	flag.Annotations[BashCompOneRequiredFlag] = annotation
+// MarkFlagRequired adds the BashCompOneRequiredFlag annotation to the named flag, if it exists.
+func (cmd *Command) MarkFlagRequired(name string) error {
+	return MarkFlagRequired(cmd.Flags(), name)
+}
+
+// MarkFlagRequired adds the BashCompOneRequiredFlag annotation to the named flag in the flag set, if it exists.
+func MarkFlagRequired(flags *pflag.FlagSet, name string) error {
+	return flags.SetAnnotation(name, BashCompOneRequiredFlag, []string{"true"})
+}
+
+// MarkFlagFilename adds the BashCompFilenameExt annotation to the named flag, if it exists.
+// Generated bash autocompletion will select filenames for the flag, limiting to named extensions if provided.
+func (cmd *Command) MarkFlagFilename(name string, extensions ...string) error {
+	return MarkFlagFilename(cmd.Flags(), name, extensions...)
+}
+
+// MarkFlagFilename adds the BashCompFilenameExt annotation to the named flag in the flag set, if it exists.
+// Generated bash autocompletion will select filenames for the flag, limiting to named extensions if provided.
+func MarkFlagFilename(flags *pflag.FlagSet, name string, extensions ...string) error {
+	return flags.SetAnnotation(name, BashCompFilenameExt, extensions)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions_test.go b/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions_test.go
deleted file mode 100644
index ee632cf49a..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/cobra/bash_completions_test.go
+++ /dev/null
@@ -1,82 +0,0 @@
-package cobra
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-)
-
-var _ = fmt.Println
-var _ = os.Stderr
-
-func checkOmit(t *testing.T, found, unexpected string) {
-	if strings.Contains(found, unexpected) {
-		t.Errorf("Unexpected response.\nGot: %q\nBut should not have!\n", unexpected)
-	}
-}
-
-func check(t *testing.T, found, expected string) {
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-}
-
-// World worst custom function, just keep telling you to enter hello!
-const (
-	bash_completion_func = `__custom_func() {
-COMPREPLY=( "hello" )
-}
-`
-)
-
-func TestBashCompletions(t *testing.T) {
-	c := initializeWithRootCmd()
-	cmdEcho.AddCommand(cmdTimes)
-	c.AddCommand(cmdEcho, cmdPrint, cmdDeprecated)
-
-	// custom completion function
-	c.BashCompletionFunction = bash_completion_func
-
-	// required flag
-	c.MarkFlagRequired("introot")
-
-	// valid nounds
-	validArgs := []string{"pods", "nodes", "services", "replicationControllers"}
-	c.ValidArgs = validArgs
-
-	// filename extentions
-	annotations := make([]string, 3)
-	annotations[0] = "json"
-	annotations[1] = "yaml"
-	annotations[2] = "yml"
-
-	annotation := make(map[string][]string)
-	annotation[BashCompFilenameExt] = annotations
-
-	var flagval string
-	c.Flags().StringVar(&flagval, "filename", "", "Enter a filename")
-	flag := c.Flags().Lookup("filename")
-	flag.Annotations = annotation
-
-	out := new(bytes.Buffer)
-	c.GenBashCompletion(out)
-	str := out.String()
-
-	check(t, str, "_cobra-test")
-	check(t, str, "_cobra-test_echo")
-	check(t, str, "_cobra-test_echo_times")
-	check(t, str, "_cobra-test_print")
-
-	// check for required flags
-	check(t, str, `must_have_one_flag+=("--introot=")`)
-	// check for custom completion function
-	check(t, str, `COMPREPLY=( "hello" )`)
-	// check for required nouns
-	check(t, str, `must_have_one_noun+=("pods")`)
-	// check for filename extention flags
-	check(t, str, `flags_completion+=("__handle_filename_extension_flag json|yaml|yml")`)
-
-	checkOmit(t, str, cmdDeprecated.Name())
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra.go
index 78b92b0af3..20957cdd1f 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/cobra.go
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra.go
@@ -23,8 +23,17 @@ import (
 	"strconv"
 	"strings"
 	"text/template"
+	"unicode"
 )
 
+var templateFuncs template.FuncMap = template.FuncMap{
+	"trim":           strings.TrimSpace,
+	"trimRightSpace": trimRightSpace,
+	"rpad":           rpad,
+	"gt":             Gt,
+	"eq":             Eq,
+}
+
 var initializers []func()
 
 // automatic prefix matching can be a dangerous thing to automatically enable in CLI tools.
@@ -39,6 +48,20 @@ var MousetrapHelpText string = `This is a command line tool
 You need to open cmd.exe and run it from there.
 `
 
+//AddTemplateFunc adds a template function that's available to Usage and Help
+//template generation.
+func AddTemplateFunc(name string, tmplFunc interface{}) {
+	templateFuncs[name] = tmplFunc
+}
+
+//AddTemplateFuncs adds multiple template functions availalble to Usage and
+//Help template generation.
+func AddTemplateFuncs(tmplFuncs template.FuncMap) {
+	for k, v := range tmplFuncs {
+		templateFuncs[k] = v
+	}
+}
+
 //OnInitialize takes a series of func() arguments and appends them to a slice of func().
 func OnInitialize(y ...func()) {
 	for _, x := range y {
@@ -92,6 +115,10 @@ func Eq(a interface{}, b interface{}) bool {
 	return false
 }
 
+func trimRightSpace(s string) string {
+	return strings.TrimRightFunc(s, unicode.IsSpace)
+}
+
 //rpad adds padding to the right of a string
 func rpad(s string, padding int) string {
 	template := fmt.Sprintf("%%-%ds", padding)
@@ -101,12 +128,43 @@ func rpad(s string, padding int) string {
 // tmpl executes the given template text on data, writing the result to w.
 func tmpl(w io.Writer, text string, data interface{}) error {
 	t := template.New("top")
-	t.Funcs(template.FuncMap{
-		"trim": strings.TrimSpace,
-		"rpad": rpad,
-		"gt":   Gt,
-		"eq":   Eq,
-	})
+	t.Funcs(templateFuncs)
 	template.Must(t.Parse(text))
 	return t.Execute(w, data)
 }
+
+// ld compares two strings and returns the levenshtein distance between them
+func ld(s, t string, ignoreCase bool) int {
+	if ignoreCase {
+		s = strings.ToLower(s)
+		t = strings.ToLower(t)
+	}
+	d := make([][]int, len(s)+1)
+	for i := range d {
+		d[i] = make([]int, len(t)+1)
+	}
+	for i := range d {
+		d[i][0] = i
+	}
+	for j := range d[0] {
+		d[0][j] = j
+	}
+	for j := 1; j <= len(t); j++ {
+		for i := 1; i <= len(s); i++ {
+			if s[i-1] == t[j-1] {
+				d[i][j] = d[i-1][j-1]
+			} else {
+				min := d[i-1][j]
+				if d[i][j-1] < min {
+					min = d[i][j-1]
+				}
+				if d[i-1][j-1] < min {
+					min = d[i-1][j-1]
+				}
+				d[i][j] = min + 1
+			}
+		}
+
+	}
+	return d[len(s)][len(t)]
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/add.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/add.go
new file mode 100644
index 0000000000..9de5821403
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/add.go
@@ -0,0 +1,125 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func init() {
+	RootCmd.AddCommand(addCmd)
+}
+
+var pName string
+
+// initialize Command
+var addCmd = &cobra.Command{
+	Use:     "add [command name]",
+	Aliases: []string{"command"},
+	Short:   "Add a command to a Cobra Application",
+	Long: `Add will create a new command, with a license and the appropriate structure
+	for a Cobra based CLI application and register it to it's parent (default RootCmd).
+
+  If you want your command to be public, pass in the command name with an initial upper case letter.
+
+  Example: cobra add server  -> resulting in a new cmd/server.go
+  `,
+
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) != 1 {
+			er("add needs a name for the command")
+		}
+		guessProjectPath()
+		createCmdFile(args[0])
+	},
+}
+
+func init() {
+	addCmd.Flags().StringVarP(&pName, "parent", "p", "RootCmd", "name of parent command for this command")
+}
+
+func parentName() string {
+	if !strings.HasSuffix(strings.ToLower(pName), "cmd") {
+		return pName + "Cmd"
+	}
+
+	return pName
+}
+
+func createCmdFile(cmdName string) {
+	lic := getLicense()
+
+	template := `{{ comment .copyright }}
+//
+{{ comment .license }}
+package cmd
+
+import (
+  "fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// {{.cmdName}}Cmd respresents the {{.cmdName}} command
+var {{ .cmdName }}Cmd = &cobra.Command{
+	Use:   "{{ .cmdName }}",
+	Short: "A brief description of your command",
+	Long: ` + "`" + `A longer description that spans multiple lines and likely contains examples
+and usage of using your command. For example:
+
+Cobra is a Cli library for Go that empowers applications. This
+application is a tool to generate the needed files to quickly create a Cobra
+application.` + "`" + `,
+	Run: func(cmd *cobra.Command, args []string) {
+    // TODO: Work your own magic here
+    fmt.Println("{{ .cmdName }} called")
+   },
+}
+
+func init() {
+	{{ .parentName }}.AddCommand({{ .cmdName }}Cmd)
+
+	// Here you will define your flags and configuration settings
+
+	// Cobra supports Persistent Flags which will work for this command and all subcommands
+  // {{.cmdName}}Cmd.PersistentFlags().String("foo", "", "A help for foo")
+
+	// Cobra supports local flags which will only run when this command is called directly
+	// {{.cmdName}}Cmd.Flags().BoolP("toggle", "t", false, "Help message for toggle" )
+
+}
+`
+
+	var data map[string]interface{}
+	data = make(map[string]interface{})
+
+	data["copyright"] = copyrightLine()
+	data["license"] = lic.Header
+	data["appName"] = projectName()
+	data["viper"] = viper.GetBool("useViper")
+	data["parentName"] = parentName()
+	data["cmdName"] = cmdName
+
+	err := writeTemplateToFile(ProjectPath()+string(os.PathSeparator)+guessCmdDir(), cmdName+".go", template, data)
+	if err != nil {
+		er(err)
+	}
+	fmt.Println(cmdName, "created at", filepath.Join(ProjectPath()+string(os.PathSeparator)+guessCmdDir(), cmdName+".go"))
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/helpers.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/helpers.go
new file mode 100644
index 0000000000..28f7003930
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/helpers.go
@@ -0,0 +1,342 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+// var BaseDir = ""
+// var AppName = ""
+// var CommandDir = ""
+
+var funcMap template.FuncMap
+var projectPath = ""
+var inputPath = ""
+var projectBase = ""
+
+// for testing only
+var testWd = ""
+
+var cmdDirs = []string{"cmd", "cmds", "command", "commands"}
+
+func init() {
+	funcMap = template.FuncMap{
+		"comment": commentifyString,
+	}
+}
+
+func er(msg interface{}) {
+	fmt.Println("Error:", msg)
+	os.Exit(-1)
+}
+
+// Check if a file or directory exists.
+func exists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true, nil
+	}
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+func ProjectPath() string {
+	if projectPath == "" {
+		guessProjectPath()
+	}
+
+	return projectPath
+}
+
+// wrapper of the os package so we can test better
+func getWd() (string, error) {
+	if testWd == "" {
+		return os.Getwd()
+	}
+	return testWd, nil
+}
+
+func guessCmdDir() string {
+	guessProjectPath()
+	if b, _ := isEmpty(projectPath); b {
+		return "cmd"
+	}
+
+	files, _ := filepath.Glob(projectPath + string(os.PathSeparator) + "c*")
+	for _, f := range files {
+		for _, c := range cmdDirs {
+			if f == c {
+				return c
+			}
+		}
+	}
+
+	return "cmd"
+}
+
+func guessImportPath() string {
+	guessProjectPath()
+
+	if !strings.HasPrefix(projectPath, getSrcPath()) {
+		er("Cobra only supports project within $GOPATH")
+	}
+
+	return strings.TrimPrefix(projectPath, getSrcPath())
+}
+
+func getSrcPath() string {
+	return os.Getenv("GOPATH") + string(os.PathSeparator) + "src" + string(os.PathSeparator)
+}
+
+func projectName() string {
+	return filepath.Base(ProjectPath())
+}
+
+func guessProjectPath() {
+	// if no path is provided... assume CWD.
+	if inputPath == "" {
+		x, err := getWd()
+		if err != nil {
+			er(err)
+		}
+
+		// inspect CWD
+		base := filepath.Base(x)
+
+		// if we are in the cmd directory.. back up
+		for _, c := range cmdDirs {
+			if base == c {
+				projectPath = filepath.Dir(x)
+				return
+			}
+		}
+
+		if projectPath == "" {
+			projectPath = x
+			return
+		}
+	}
+
+	srcPath := getSrcPath()
+	// if provided inspect for logical locations
+	if strings.ContainsRune(inputPath, os.PathSeparator) {
+		if filepath.IsAbs(inputPath) {
+			// if Absolute, use it
+			projectPath = inputPath
+			return
+		}
+		// If not absolute but contains slashes.. assuming it means create it from $GOPATH
+		count := strings.Count(inputPath, string(os.PathSeparator))
+
+		switch count {
+		// If only one directory deep assume "github.com"
+		case 1:
+			projectPath = srcPath + "github.com" + string(os.PathSeparator) + inputPath
+			return
+		case 2:
+			projectPath = srcPath + inputPath
+			return
+		default:
+			er("Unknown directory")
+		}
+	} else {
+		// hardest case.. just a word.
+		if projectBase == "" {
+			x, err := getWd()
+			if err == nil {
+				projectPath = x + string(os.PathSeparator) + inputPath
+				return
+			}
+			er(err)
+		} else {
+			projectPath = srcPath + projectBase + string(os.PathSeparator) + inputPath
+			return
+		}
+	}
+}
+
+// IsEmpty checks if a given path is empty.
+func isEmpty(path string) (bool, error) {
+	if b, _ := exists(path); !b {
+		return false, fmt.Errorf("%q path does not exist", path)
+	}
+	fi, err := os.Stat(path)
+	if err != nil {
+		return false, err
+	}
+	if fi.IsDir() {
+		f, err := os.Open(path)
+		// FIX: Resource leak - f.close() should be called here by defer or is missed
+		// if the err != nil branch is taken.
+		defer f.Close()
+		if err != nil {
+			return false, err
+		}
+		list, err := f.Readdir(-1)
+		// f.Close() - see bug fix above
+		return len(list) == 0, nil
+	}
+	return fi.Size() == 0, nil
+}
+
+// IsDir checks if a given path is a directory.
+func isDir(path string) (bool, error) {
+	fi, err := os.Stat(path)
+	if err != nil {
+		return false, err
+	}
+	return fi.IsDir(), nil
+}
+
+// DirExists checks if a path exists and is a directory.
+func dirExists(path string) (bool, error) {
+	fi, err := os.Stat(path)
+	if err == nil && fi.IsDir() {
+		return true, nil
+	}
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+func writeTemplateToFile(path string, file string, template string, data interface{}) error {
+	filename := filepath.Join(path, file)
+
+	r, err := templateToReader(template, data)
+
+	if err != nil {
+		return err
+	}
+
+	err = safeWriteToDisk(filename, r)
+
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func writeStringToFile(path, file, text string) error {
+	filename := filepath.Join(path, file)
+
+	r := strings.NewReader(text)
+	err := safeWriteToDisk(filename, r)
+
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func templateToReader(tpl string, data interface{}) (io.Reader, error) {
+	tmpl := template.New("")
+	tmpl.Funcs(funcMap)
+	tmpl, err := tmpl.Parse(tpl)
+
+	if err != nil {
+		return nil, err
+	}
+	buf := new(bytes.Buffer)
+	err = tmpl.Execute(buf, data)
+
+	return buf, err
+}
+
+// Same as WriteToDisk but checks to see if file/directory already exists.
+func safeWriteToDisk(inpath string, r io.Reader) (err error) {
+	dir, _ := filepath.Split(inpath)
+	ospath := filepath.FromSlash(dir)
+
+	if ospath != "" {
+		err = os.MkdirAll(ospath, 0777) // rwx, rw, r
+		if err != nil {
+			return
+		}
+	}
+
+	ex, err := exists(inpath)
+	if err != nil {
+		return
+	}
+	if ex {
+		return fmt.Errorf("%v already exists", inpath)
+	}
+
+	file, err := os.Create(inpath)
+	if err != nil {
+		return
+	}
+	defer file.Close()
+
+	_, err = io.Copy(file, r)
+	return
+}
+
+func getLicense() License {
+	l := whichLicense()
+	if l != "" {
+		if x, ok := Licenses[l]; ok {
+			return x
+		}
+	}
+
+	return Licenses["apache"]
+}
+
+func whichLicense() string {
+	// if explicitly flagged use that
+	if userLicense != "" {
+		return matchLicense(userLicense)
+	}
+
+	// if already present in the project, use that
+	// TODO:Inpect project for existing license
+
+	// default to viper's setting
+
+	return matchLicense(viper.GetString("license"))
+}
+
+func copyrightLine() string {
+	author := viper.GetString("author")
+	year := time.Now().Format("2006")
+
+	return "Copyright ©" + year + " " + author
+}
+
+func commentifyString(in string) string {
+	var newlines []string
+	lines := strings.Split(in, "\n")
+	for _, x := range lines {
+		if !strings.HasPrefix(x, "//") {
+			newlines = append(newlines, "// "+x)
+		} else {
+			newlines = append(newlines, x)
+		}
+	}
+	return strings.Join(newlines, "\n")
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/init.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/init.go
new file mode 100644
index 0000000000..51e74471f2
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/init.go
@@ -0,0 +1,219 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func init() {
+	RootCmd.AddCommand(initCmd)
+}
+
+// initialize Command
+var initCmd = &cobra.Command{
+	Use:     "init [name]",
+	Aliases: []string{"initialize", "initalise", "create"},
+	Short:   "Initalize a Cobra Application",
+	Long: `Initalize will create a new application, with a license and the appropriate structure
+	for a Cobra based CLI application.
+
+	If a name is provided it will create it in the current directory.
+	If no name is provided it will assume the current directory.
+	If a relative path is provided it will create it inside of $GOPATH (eg github.com/spf13/hugo).
+	If an absolute path is provided it will create it.
+
+	If the directory already exists but is empty it will use it.
+
+	Init will not use an exiting directory with contents.`,
+
+	Run: func(cmd *cobra.Command, args []string) {
+		switch len(args) {
+		case 0:
+			inputPath = ""
+
+		case 1:
+			inputPath = args[0]
+
+		default:
+			er("init doesn't support more than 1 parameter")
+		}
+		guessProjectPath()
+		initalizePath(projectPath)
+	},
+}
+
+func initalizePath(path string) {
+	b, err := exists(path)
+	if err != nil {
+		er(err)
+	}
+
+	if !b { // If path doesn't yet exist, create it
+		err := os.MkdirAll(path, os.ModePerm)
+		if err != nil {
+			er(err)
+		}
+	} else { // If path exists and is not empty don't use it
+		empty, err := exists(path)
+		if err != nil {
+			er(err)
+		}
+		if !empty {
+			er("Cobra will not create a new project in a non empty directory")
+		}
+	}
+	// We have a directory and it's empty.. Time to initialize it.
+
+	createLicenseFile()
+	createMainFile()
+	createRootCmdFile()
+}
+
+func createLicenseFile() {
+	lic := getLicense()
+	err := writeStringToFile(ProjectPath(), "LICENSE", lic.Text)
+	_ = err
+	// if err != nil {
+	// 	er(err)
+	// }
+}
+
+func createMainFile() {
+	lic := getLicense()
+
+	template := `{{ comment .copyright }}
+//
+{{ comment .license }}
+
+package main
+
+import "{{ .importpath }}"
+
+func main() {
+	cmd.Execute()
+}
+`
+	var data map[string]interface{}
+	data = make(map[string]interface{})
+
+	data["copyright"] = copyrightLine()
+	data["license"] = lic.Header
+	data["importpath"] = guessImportPath() + "/" + guessCmdDir()
+
+	err := writeTemplateToFile(ProjectPath(), "main.go", template, data)
+	_ = err
+	// if err != nil {
+	// 	er(err)
+	// }
+}
+
+func createRootCmdFile() {
+	lic := getLicense()
+
+	template := `{{ comment .copyright }}
+//
+{{ comment .license }}
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	{{ if .viper }}"github.com/spf13/viper"{{ end }}
+)
+
+{{if .viper}}
+var cfgFile string
+{{ end }}
+
+// This represents the base command when called without any subcommands
+var RootCmd = &cobra.Command{
+	Use:   "{{ .appName }}",
+	Short: "A brief description of your application",
+	Long: ` + "`" + `A longer description that spans multiple lines and likely contains examples
+and usage of using your application. For example:
+
+Cobra is a Cli library for Go that empowers applications. This
+application is a tool to generate the needed files to quickly create a Cobra
+application.` + "`" + `,
+// Uncomment the following line if your bare application has an action associated with it
+//	Run: func(cmd *cobra.Command, args []string) { },
+}
+
+//Execute adds all child commands to the root command sets flags appropriately.
+// This is called by main.main(). It only needs to happen once to the rootCmd
+func Execute() {
+	if err := RootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(-1)
+	}
+}
+
+func init() {
+	{{ if .viper }}cobra.OnInitialize(initConfig){{ end}}
+	// Here you will define your flags and configuration settings
+	// Cobra supports Persistent Flags which if defined here will be global for your application
+	{{ if .viper }}
+  RootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is $HOME/.{{ .appName }}.yaml)")
+	{{ else }}
+  // RootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is $HOME/.{{ .appName }}.yaml)")
+	{{ end }}
+	// Cobra also supports local flags which will only run when this action is called directly
+	RootCmd.Flags().BoolP("toggle", "t", false, "Help message for toggle" )
+
+}
+
+{{ if .viper }}
+// Read in config file and ENV variables if set.
+func initConfig() {
+	if cfgFile != "" { // enable ability to specify config file via flag
+		viper.SetConfigFile(cfgFile)
+	}
+
+	viper.SetConfigName(".{{ .appName }}") // name of config file (without extension)
+	viper.AddConfigPath("$HOME")  // adding home directory as first search path
+	viper.AutomaticEnv()          // read in environment variables that match
+
+	// If a config file is found, read it in.
+	if err := viper.ReadInConfig(); err == nil {
+		fmt.Println("Using config file:", viper.ConfigFileUsed())
+	}
+}
+{{ end }}
+`
+
+	var data map[string]interface{}
+	data = make(map[string]interface{})
+
+	data["copyright"] = copyrightLine()
+	data["license"] = lic.Header
+	data["appName"] = projectName()
+	data["viper"] = viper.GetBool("useViper")
+
+	err := writeTemplateToFile(ProjectPath()+string(os.PathSeparator)+guessCmdDir(), "root.go", template, data)
+	if err != nil {
+		er(err)
+	}
+
+	fmt.Println("Yor Cobra application is ready at")
+	fmt.Println(ProjectPath())
+	fmt.Println("Give it a try by going there and running `go run main.go`")
+	fmt.Println("Add commands to it by running `cobra add [cmdname]`")
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/licenses.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/licenses.go
new file mode 100644
index 0000000000..67041a0d68
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/licenses.go
@@ -0,0 +1,435 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Parts inspired by https://github.com/ryanuber/go-license
+
+package cmd
+
+import "strings"
+
+var Licenses map[string]License
+
+type License struct {
+	Name            string   // The type of license in use
+	PossibleMatches []string // Similar names to guess
+	Text            string   // License text data
+	Header          string   // License header for source files
+}
+
+// given a license name (in), try to match the license indicated
+func matchLicense(in string) string {
+	for key, lic := range Licenses {
+		for _, match := range lic.PossibleMatches {
+			if strings.EqualFold(in, match) {
+				return key
+			}
+		}
+	}
+	return ""
+}
+
+func init() {
+	Licenses = make(map[string]License)
+
+	Licenses["apache"] = License{
+		Name:            "Apache 2.0",
+		PossibleMatches: []string{"apache", "apache20", "apache 2.0", "apache2.0", "apache-2.0"},
+		Header: `
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+    `,
+		Text: `
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+    `,
+	}
+
+	Licenses["mit"] = License{
+		Name:            "Mit",
+		PossibleMatches: []string{"mit"},
+		Header: `
+    The MIT License (MIT)
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+    `,
+		Text: `
+    The MIT License (MIT)
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+    `,
+	}
+
+	Licenses["bsd"] = License{
+		Name:            "NewBSD",
+		PossibleMatches: []string{"bsd", "newbsd", "3 clause bsd"},
+		Header: `
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+        * Redistributions of source code must retain the above copyright
+          notice, this list of conditions and the following disclaimer.
+        * Redistributions in binary form must reproduce the above copyright
+          notice, this list of conditions and the following disclaimer in the
+          documentation and/or other materials provided with the distribution.
+        * Neither the name of the <organization> nor the
+          names of its contributors may be used to endorse or promote products
+          derived from this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+    DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+    DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+    LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+    SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+    `,
+		Text: `
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+        * Redistributions of source code must retain the above copyright
+          notice, this list of conditions and the following disclaimer.
+        * Redistributions in binary form must reproduce the above copyright
+          notice, this list of conditions and the following disclaimer in the
+          documentation and/or other materials provided with the distribution.
+        * Neither the name of the <organization> nor the
+          names of its contributors may be used to endorse or promote products
+          derived from this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+    DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+    DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+    LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+    SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+    `,
+	}
+
+	Licenses["freebsd"] = License{
+		Name:            "Simplified BSD License",
+		PossibleMatches: []string{"freebsd", "simpbsd", "simple bsd", "2 clause bsd"},
+		Header: `
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those
+of the authors and should not be interpreted as representing official policies,
+either expressed or implied, of the FreeBSD Project.
+    `,
+		Text: `
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those
+of the authors and should not be interpreted as representing official policies,
+either expressed or implied, of the FreeBSD Project.
+    `,
+	}
+
+	// Licenses["apache20"] = License{
+	// 	Name:            "Apache 2.0",
+	// 	PossibleMatches: []string{"apache", "apache20", ""},
+	//   Header: `
+	//   `,
+	// 	Text: `
+	//   `,
+	// }
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/root.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/root.go
new file mode 100644
index 0000000000..5e2d0992d0
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/cmd/root.go
@@ -0,0 +1,84 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+var cfgFile string
+var userLicense string
+
+// This represents the base command when called without any subcommands
+var RootCmd = &cobra.Command{
+	Use:   "cobra",
+	Short: "A generator for Cobra based Applications",
+	Long: `Cobra is a Cli library for Go that empowers applications. This
+    application is a tool to generate the needed files to quickly create a Cobra
+    application.`,
+}
+
+//Execute adds all child commands to the root command sets flags appropriately.
+func Execute() {
+	if err := RootCmd.Execute(); err != nil {
+		fmt.Println(err)
+		os.Exit(-1)
+	}
+}
+
+func init() {
+	cobra.OnInitialize(initConfig)
+	RootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is $HOME/.cobra.yaml)")
+	RootCmd.PersistentFlags().StringVarP(&projectBase, "projectbase", "b", "", "base project directory eg. github.com/spf13/")
+	RootCmd.PersistentFlags().StringP("author", "a", "YOUR NAME", "Author name for copyright attribution")
+	RootCmd.PersistentFlags().StringVarP(&userLicense, "license", "l", "", "Name of license for the project (can provide `licensetext` in config)")
+	RootCmd.PersistentFlags().Bool("viper", true, "Use Viper for configuration")
+	viper.BindPFlag("author", RootCmd.PersistentFlags().Lookup("author"))
+	viper.BindPFlag("projectbase", RootCmd.PersistentFlags().Lookup("projectbase"))
+	viper.BindPFlag("useViper", RootCmd.PersistentFlags().Lookup("viper"))
+	viper.SetDefault("author", "NAME HERE <EMAIL ADDRESS>")
+	viper.SetDefault("license", "apache")
+	viper.SetDefault("licenseText", `
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+`)
+}
+
+// Read in config file and ENV variables if set.
+func initConfig() {
+	if cfgFile != "" { // enable ability to specify config file via flag
+		viper.SetConfigFile(cfgFile)
+	}
+
+	viper.SetConfigName(".cobra") // name of config file (without extension)
+	viper.AddConfigPath("$HOME")  // adding home directory as first search path
+	viper.AutomaticEnv()          // read in environment variables that match
+
+	// If a config file is found, read it in.
+	if err := viper.ReadInConfig(); err == nil {
+		fmt.Println("Using config file:", viper.ConfigFileUsed())
+	}
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra/main.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/main.go
new file mode 100644
index 0000000000..c3a9d9cb04
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/cobra/main.go
@@ -0,0 +1,20 @@
+// Copyright © 2015 Steve Francia <spf@spf13.com>.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import "github.com/spf13/cobra/cobra/cmd"
+
+func main() {
+	cmd.Execute()
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/cobra_test.go b/Godeps/_workspace/src/github.com/spf13/cobra/cobra_test.go
deleted file mode 100644
index 9848d211f4..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/cobra/cobra_test.go
+++ /dev/null
@@ -1,942 +0,0 @@
-package cobra
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"reflect"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/spf13/pflag"
-)
-
-var _ = fmt.Println
-var _ = os.Stderr
-
-var tp, te, tt, t1, tr []string
-var rootPersPre, echoPre, echoPersPre, timesPersPre []string
-var flagb1, flagb2, flagb3, flagbr, flagbp bool
-var flags1, flags2a, flags2b, flags3 string
-var flagi1, flagi2, flagi3, flagir int
-var globalFlag1 bool
-var flagEcho, rootcalled bool
-var versionUsed int
-
-const strtwoParentHelp = "help message for parent flag strtwo"
-const strtwoChildHelp = "help message for child flag strtwo"
-
-var cmdPrint = &Command{
-	Use:   "print [string to print]",
-	Short: "Print anything to the screen",
-	Long:  `an absolutely utterly useless command for testing.`,
-	Run: func(cmd *Command, args []string) {
-		tp = args
-	},
-}
-
-var cmdEcho = &Command{
-	Use:     "echo [string to echo]",
-	Aliases: []string{"say"},
-	Short:   "Echo anything to the screen",
-	Long:    `an utterly useless command for testing.`,
-	Example: "Just run cobra-test echo",
-	PersistentPreRun: func(cmd *Command, args []string) {
-		echoPersPre = args
-	},
-	PreRun: func(cmd *Command, args []string) {
-		echoPre = args
-	},
-	Run: func(cmd *Command, args []string) {
-		te = args
-	},
-}
-
-var cmdEchoSub = &Command{
-	Use:   "echosub [string to print]",
-	Short: "second sub command for echo",
-	Long:  `an absolutely utterly useless command for testing gendocs!.`,
-	Run: func(cmd *Command, args []string) {
-	},
-}
-
-var cmdDeprecated = &Command{
-	Use:        "deprecated [can't do anything here]",
-	Short:      "A command which is deprecated",
-	Long:       `an absolutely utterly useless command for testing deprecation!.`,
-	Deprecated: "Please use echo instead",
-	Run: func(cmd *Command, args []string) {
-	},
-}
-
-var cmdTimes = &Command{
-	Use:   "times [# times] [string to echo]",
-	Short: "Echo anything to the screen more times",
-	Long:  `a slightly useless command for testing.`,
-	PersistentPreRun: func(cmd *Command, args []string) {
-		timesPersPre = args
-	},
-	Run: func(cmd *Command, args []string) {
-		tt = args
-	},
-}
-
-var cmdRootNoRun = &Command{
-	Use:   "cobra-test",
-	Short: "The root can run it's own function",
-	Long:  "The root description for help",
-	PersistentPreRun: func(cmd *Command, args []string) {
-		rootPersPre = args
-	},
-}
-
-var cmdRootSameName = &Command{
-	Use:   "print",
-	Short: "Root with the same name as a subcommand",
-	Long:  "The root description for help",
-}
-
-var cmdRootWithRun = &Command{
-	Use:   "cobra-test",
-	Short: "The root can run it's own function",
-	Long:  "The root description for help",
-	Run: func(cmd *Command, args []string) {
-		tr = args
-		rootcalled = true
-	},
-}
-
-var cmdSubNoRun = &Command{
-	Use:   "subnorun",
-	Short: "A subcommand without a Run function",
-	Long:  "A long output about a subcommand without a Run function",
-}
-
-var cmdVersion1 = &Command{
-	Use:   "version",
-	Short: "Print the version number",
-	Long:  `First version of the version command`,
-	Run: func(cmd *Command, args []string) {
-		versionUsed = 1
-	},
-}
-
-var cmdVersion2 = &Command{
-	Use:   "version",
-	Short: "Print the version number",
-	Long:  `Second version of the version command`,
-	Run: func(cmd *Command, args []string) {
-		versionUsed = 2
-	},
-}
-
-func flagInit() {
-	cmdEcho.ResetFlags()
-	cmdPrint.ResetFlags()
-	cmdTimes.ResetFlags()
-	cmdRootNoRun.ResetFlags()
-	cmdRootSameName.ResetFlags()
-	cmdRootWithRun.ResetFlags()
-	cmdSubNoRun.ResetFlags()
-	cmdRootNoRun.PersistentFlags().StringVarP(&flags2a, "strtwo", "t", "two", strtwoParentHelp)
-	cmdEcho.Flags().IntVarP(&flagi1, "intone", "i", 123, "help message for flag intone")
-	cmdTimes.Flags().IntVarP(&flagi2, "inttwo", "j", 234, "help message for flag inttwo")
-	cmdPrint.Flags().IntVarP(&flagi3, "intthree", "i", 345, "help message for flag intthree")
-	cmdEcho.PersistentFlags().StringVarP(&flags1, "strone", "s", "one", "help message for flag strone")
-	cmdEcho.PersistentFlags().BoolVarP(&flagbp, "persistentbool", "p", false, "help message for flag persistentbool")
-	cmdTimes.PersistentFlags().StringVarP(&flags2b, "strtwo", "t", "2", strtwoChildHelp)
-	cmdPrint.PersistentFlags().StringVarP(&flags3, "strthree", "s", "three", "help message for flag strthree")
-	cmdEcho.Flags().BoolVarP(&flagb1, "boolone", "b", true, "help message for flag boolone")
-	cmdTimes.Flags().BoolVarP(&flagb2, "booltwo", "c", false, "help message for flag booltwo")
-	cmdPrint.Flags().BoolVarP(&flagb3, "boolthree", "b", true, "help message for flag boolthree")
-	cmdVersion1.ResetFlags()
-	cmdVersion2.ResetFlags()
-}
-
-func commandInit() {
-	cmdEcho.ResetCommands()
-	cmdPrint.ResetCommands()
-	cmdTimes.ResetCommands()
-	cmdRootNoRun.ResetCommands()
-	cmdRootSameName.ResetCommands()
-	cmdRootWithRun.ResetCommands()
-	cmdSubNoRun.ResetCommands()
-}
-
-func initialize() *Command {
-	tt, tp, te = nil, nil, nil
-	rootPersPre, echoPre, echoPersPre, timesPersPre = nil, nil, nil, nil
-
-	var c = cmdRootNoRun
-	flagInit()
-	commandInit()
-	return c
-}
-
-func initializeWithSameName() *Command {
-	tt, tp, te = nil, nil, nil
-	rootPersPre, echoPre, echoPersPre, timesPersPre = nil, nil, nil, nil
-	var c = cmdRootSameName
-	flagInit()
-	commandInit()
-	return c
-}
-
-func initializeWithRootCmd() *Command {
-	cmdRootWithRun.ResetCommands()
-	tt, tp, te, tr, rootcalled = nil, nil, nil, nil, false
-	flagInit()
-	cmdRootWithRun.Flags().BoolVarP(&flagbr, "boolroot", "b", false, "help message for flag boolroot")
-	cmdRootWithRun.Flags().IntVarP(&flagir, "introot", "i", 321, "help message for flag introot")
-	commandInit()
-	return cmdRootWithRun
-}
-
-type resulter struct {
-	Error   error
-	Output  string
-	Command *Command
-}
-
-func fullSetupTest(input string) resulter {
-	c := initializeWithRootCmd()
-
-	return fullTester(c, input)
-}
-
-func noRRSetupTest(input string) resulter {
-	c := initialize()
-
-	return fullTester(c, input)
-}
-
-func rootOnlySetupTest(input string) resulter {
-	c := initializeWithRootCmd()
-
-	return simpleTester(c, input)
-}
-
-func simpleTester(c *Command, input string) resulter {
-	buf := new(bytes.Buffer)
-	// Testing flag with invalid input
-	c.SetOutput(buf)
-	c.SetArgs(strings.Split(input, " "))
-
-	err := c.Execute()
-	output := buf.String()
-
-	return resulter{err, output, c}
-}
-
-func fullTester(c *Command, input string) resulter {
-	buf := new(bytes.Buffer)
-	// Testing flag with invalid input
-	c.SetOutput(buf)
-	cmdEcho.AddCommand(cmdTimes)
-	c.AddCommand(cmdPrint, cmdEcho, cmdSubNoRun, cmdDeprecated)
-	c.SetArgs(strings.Split(input, " "))
-
-	err := c.Execute()
-	output := buf.String()
-
-	return resulter{err, output, c}
-}
-
-func logErr(t *testing.T, found, expected string) {
-	out := new(bytes.Buffer)
-
-	_, _, line, ok := runtime.Caller(2)
-	if ok {
-		fmt.Fprintf(out, "Line: %d ", line)
-	}
-	fmt.Fprintf(out, "Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	t.Errorf(out.String())
-}
-
-func checkResultContains(t *testing.T, x resulter, check string) {
-	if !strings.Contains(x.Output, check) {
-		logErr(t, x.Output, check)
-	}
-}
-
-func checkResultOmits(t *testing.T, x resulter, check string) {
-	if strings.Contains(x.Output, check) {
-		logErr(t, x.Output, check)
-	}
-}
-
-func checkOutputContains(t *testing.T, c *Command, check string) {
-	buf := new(bytes.Buffer)
-	c.SetOutput(buf)
-	c.Execute()
-
-	if !strings.Contains(buf.String(), check) {
-		logErr(t, buf.String(), check)
-	}
-}
-
-func TestSingleCommand(t *testing.T) {
-	noRRSetupTest("print one two")
-
-	if te != nil || tt != nil {
-		t.Error("Wrong command called")
-	}
-	if tp == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tp, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-}
-
-func TestChildCommand(t *testing.T) {
-	noRRSetupTest("echo times one two")
-
-	if te != nil || tp != nil {
-		t.Error("Wrong command called")
-	}
-	if tt == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tt, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-}
-
-func TestCommandAlias(t *testing.T) {
-	noRRSetupTest("say times one two")
-
-	if te != nil || tp != nil {
-		t.Error("Wrong command called")
-	}
-	if tt == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tt, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-}
-
-func TestPrefixMatching(t *testing.T) {
-	EnablePrefixMatching = true
-	noRRSetupTest("ech times one two")
-
-	if te != nil || tp != nil {
-		t.Error("Wrong command called")
-	}
-	if tt == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tt, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-
-	EnablePrefixMatching = false
-}
-
-func TestNoPrefixMatching(t *testing.T) {
-	EnablePrefixMatching = false
-
-	noRRSetupTest("ech times one two")
-
-	if !(tt == nil && te == nil && tp == nil) {
-		t.Error("Wrong command called")
-	}
-}
-
-func TestAliasPrefixMatching(t *testing.T) {
-	EnablePrefixMatching = true
-	noRRSetupTest("sa times one two")
-
-	if te != nil || tp != nil {
-		t.Error("Wrong command called")
-	}
-	if tt == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tt, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-	EnablePrefixMatching = false
-}
-
-func TestChildSameName(t *testing.T) {
-	c := initializeWithSameName()
-	c.AddCommand(cmdPrint, cmdEcho)
-	c.SetArgs(strings.Split("print one two", " "))
-	c.Execute()
-
-	if te != nil || tt != nil {
-		t.Error("Wrong command called")
-	}
-	if tp == nil {
-		t.Error("Wrong command called")
-	}
-	if strings.Join(tp, " ") != "one two" {
-		t.Error("Command didn't parse correctly")
-	}
-}
-
-func TestFlagLong(t *testing.T) {
-	noRRSetupTest("echo --intone=13 something here")
-
-	if strings.Join(te, " ") != "something here" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", te)
-	}
-	if flagi1 != 13 {
-		t.Errorf("int flag didn't get correct value, had %d", flagi1)
-	}
-	if flagi2 != 234 {
-		t.Errorf("default flag value changed, 234 expected, %d given", flagi2)
-	}
-}
-
-func TestFlagShort(t *testing.T) {
-	noRRSetupTest("echo -i13 something here")
-
-	if strings.Join(te, " ") != "something here" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", te)
-	}
-	if flagi1 != 13 {
-		t.Errorf("int flag didn't get correct value, had %d", flagi1)
-	}
-	if flagi2 != 234 {
-		t.Errorf("default flag value changed, 234 expected, %d given", flagi2)
-	}
-
-	noRRSetupTest("echo -i 13 something here")
-
-	if strings.Join(te, " ") != "something here" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", te)
-	}
-	if flagi1 != 13 {
-		t.Errorf("int flag didn't get correct value, had %d", flagi1)
-	}
-	if flagi2 != 234 {
-		t.Errorf("default flag value changed, 234 expected, %d given", flagi2)
-	}
-
-	noRRSetupTest("print -i99 one two")
-
-	if strings.Join(tp, " ") != "one two" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", tp)
-	}
-	if flagi3 != 99 {
-		t.Errorf("int flag didn't get correct value, had %d", flagi3)
-	}
-	if flagi1 != 123 {
-		t.Errorf("default flag value changed on different command with same shortname, 234 expected, %d given", flagi2)
-	}
-}
-
-func TestChildCommandFlags(t *testing.T) {
-	noRRSetupTest("echo times -j 99 one two")
-
-	if strings.Join(tt, " ") != "one two" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", tt)
-	}
-
-	// Testing with flag that shouldn't be persistent
-	r := noRRSetupTest("echo times -j 99 -i77 one two")
-
-	if r.Error == nil {
-		t.Errorf("invalid flag should generate error")
-	}
-
-	if !strings.Contains(r.Output, "unknown shorthand") {
-		t.Errorf("Wrong error message displayed, \n %s", r.Output)
-	}
-
-	if flagi2 != 99 {
-		t.Errorf("flag value should be 99, %d given", flagi2)
-	}
-
-	if flagi1 != 123 {
-		t.Errorf("unset flag should have default value, expecting 123, given %d", flagi1)
-	}
-
-	// Testing with flag only existing on child
-	r = noRRSetupTest("echo -j 99 -i77 one two")
-
-	if r.Error == nil {
-		t.Errorf("invalid flag should generate error")
-	}
-
-	if !strings.Contains(r.Output, "unknown shorthand flag") {
-		t.Errorf("Wrong error message displayed, \n %s", r.Output)
-	}
-
-	// Testing with persistent flag overwritten by child
-	noRRSetupTest("echo times --strtwo=child one two")
-
-	if flags2b != "child" {
-		t.Errorf("flag value should be child, %s given", flags2b)
-	}
-
-	if flags2a != "two" {
-		t.Errorf("unset flag should have default value, expecting two, given %s", flags2a)
-	}
-
-	// Testing flag with invalid input
-	r = noRRSetupTest("echo -i10E")
-
-	if r.Error == nil {
-		t.Errorf("invalid input should generate error")
-	}
-
-	if !strings.Contains(r.Output, "invalid argument \"10E\" for i10E") {
-		t.Errorf("Wrong error message displayed, \n %s", r.Output)
-	}
-}
-
-func TestTrailingCommandFlags(t *testing.T) {
-	x := fullSetupTest("echo two -x")
-
-	if x.Error == nil {
-		t.Errorf("invalid flag should generate error")
-	}
-}
-
-func TestInvalidSubcommandFlags(t *testing.T) {
-	cmd := initializeWithRootCmd()
-	cmd.AddCommand(cmdTimes)
-
-	result := simpleTester(cmd, "times --inttwo=2 --badflag=bar")
-
-	checkResultContains(t, result, "unknown flag: --badflag")
-
-	if strings.Contains(result.Output, "unknown flag: --inttwo") {
-		t.Errorf("invalid --badflag flag shouldn't fail on 'unknown' --inttwo flag")
-	}
-
-}
-
-func TestSubcommandArgEvaluation(t *testing.T) {
-	cmd := initializeWithRootCmd()
-
-	first := &Command{
-		Use: "first",
-		Run: func(cmd *Command, args []string) {
-		},
-	}
-	cmd.AddCommand(first)
-
-	second := &Command{
-		Use: "second",
-		Run: func(cmd *Command, args []string) {
-			fmt.Fprintf(cmd.Out(), "%v", args)
-		},
-	}
-	first.AddCommand(second)
-
-	result := simpleTester(cmd, "first second first third")
-
-	expectedOutput := fmt.Sprintf("%v", []string{"first third"})
-	if result.Output != expectedOutput {
-		t.Errorf("exptected %v, got %v", expectedOutput, result.Output)
-	}
-}
-
-func TestPersistentFlags(t *testing.T) {
-	fullSetupTest("echo -s something -p more here")
-
-	// persistentFlag should act like normal flag on it's own command
-	if strings.Join(te, " ") != "more here" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", te)
-	}
-	if flags1 != "something" {
-		t.Errorf("string flag didn't get correct value, had %v", flags1)
-	}
-	if !flagbp {
-		t.Errorf("persistent bool flag not parsed correctly. Expected true, had %v", flagbp)
-	}
-
-	// persistentFlag should act like normal flag on it's own command
-	fullSetupTest("echo times -s again -c -p test here")
-
-	if strings.Join(tt, " ") != "test here" {
-		t.Errorf("flags didn't leave proper args remaining..%s given", tt)
-	}
-
-	if flags1 != "again" {
-		t.Errorf("string flag didn't get correct value, had %v", flags1)
-	}
-
-	if !flagb2 {
-		t.Errorf("local flag not parsed correctly. Expected true, had %v", flagb2)
-	}
-	if !flagbp {
-		t.Errorf("persistent bool flag not parsed correctly. Expected true, had %v", flagbp)
-	}
-}
-
-func TestHelpCommand(t *testing.T) {
-	x := fullSetupTest("help")
-	checkResultContains(t, x, cmdRootWithRun.Long)
-
-	x = fullSetupTest("help echo")
-	checkResultContains(t, x, cmdEcho.Long)
-
-	x = fullSetupTest("help echo times")
-	checkResultContains(t, x, cmdTimes.Long)
-}
-
-func TestChildCommandHelp(t *testing.T) {
-	c := noRRSetupTest("print --help")
-	checkResultContains(t, c, strtwoParentHelp)
-	r := noRRSetupTest("echo times --help")
-	checkResultContains(t, r, strtwoChildHelp)
-}
-
-func TestNonRunChildHelp(t *testing.T) {
-	x := noRRSetupTest("subnorun")
-	checkResultContains(t, x, cmdSubNoRun.Long)
-}
-
-func TestRunnableRootCommand(t *testing.T) {
-	fullSetupTest("")
-
-	if rootcalled != true {
-		t.Errorf("Root Function was not called")
-	}
-}
-
-func TestRunnableRootCommandNilInput(t *testing.T) {
-	empty_arg := make([]string, 0)
-	c := initializeWithRootCmd()
-
-	buf := new(bytes.Buffer)
-	// Testing flag with invalid input
-	c.SetOutput(buf)
-	cmdEcho.AddCommand(cmdTimes)
-	c.AddCommand(cmdPrint, cmdEcho)
-	c.SetArgs(empty_arg)
-
-	c.Execute()
-
-	if rootcalled != true {
-		t.Errorf("Root Function was not called")
-	}
-}
-
-func TestRunnableRootCommandEmptyInput(t *testing.T) {
-	args := make([]string, 3)
-	args[0] = ""
-	args[1] = "--introot=12"
-	args[2] = ""
-	c := initializeWithRootCmd()
-
-	buf := new(bytes.Buffer)
-	// Testing flag with invalid input
-	c.SetOutput(buf)
-	cmdEcho.AddCommand(cmdTimes)
-	c.AddCommand(cmdPrint, cmdEcho)
-	c.SetArgs(args)
-
-	c.Execute()
-
-	if rootcalled != true {
-		t.Errorf("Root Function was not called.\n\nOutput was:\n\n%s\n", buf)
-	}
-}
-
-func TestInvalidSubcommandWhenArgsAllowed(t *testing.T) {
-	fullSetupTest("echo invalid-sub")
-
-	if te[0] != "invalid-sub" {
-		t.Errorf("Subcommand didn't work...")
-	}
-}
-
-func TestRootFlags(t *testing.T) {
-	fullSetupTest("-i 17 -b")
-
-	if flagbr != true {
-		t.Errorf("flag value should be true, %v given", flagbr)
-	}
-
-	if flagir != 17 {
-		t.Errorf("flag value should be 17, %d given", flagir)
-	}
-}
-
-func TestRootHelp(t *testing.T) {
-	x := fullSetupTest("--help")
-
-	checkResultContains(t, x, "Available Commands:")
-	checkResultContains(t, x, "for more information about a command")
-
-	if strings.Contains(x.Output, "unknown flag: --help") {
-		t.Errorf("--help shouldn't trigger an error, Got: \n %s", x.Output)
-	}
-
-	if strings.Contains(x.Output, cmdEcho.Use) {
-		t.Errorf("--help shouldn't display subcommand's usage, Got: \n %s", x.Output)
-	}
-
-	x = fullSetupTest("echo --help")
-
-	if strings.Contains(x.Output, cmdTimes.Use) {
-		t.Errorf("--help shouldn't display subsubcommand's usage, Got: \n %s", x.Output)
-	}
-
-	checkResultContains(t, x, "Available Commands:")
-	checkResultContains(t, x, "for more information about a command")
-
-	if strings.Contains(x.Output, "unknown flag: --help") {
-		t.Errorf("--help shouldn't trigger an error, Got: \n %s", x.Output)
-	}
-
-}
-
-func TestFlagAccess(t *testing.T) {
-	initialize()
-
-	local := cmdTimes.LocalFlags()
-	inherited := cmdTimes.InheritedFlags()
-
-	for _, f := range []string{"inttwo", "strtwo", "booltwo"} {
-		if local.Lookup(f) == nil {
-			t.Errorf("LocalFlags expected to contain %s, Got: nil", f)
-		}
-	}
-	if inherited.Lookup("strone") == nil {
-		t.Errorf("InheritedFlags expected to contain strone, Got: nil")
-	}
-	if inherited.Lookup("strtwo") != nil {
-		t.Errorf("InheritedFlags shouldn not contain overwritten flag strtwo")
-
-	}
-}
-
-func TestNoNRunnableRootCommandNilInput(t *testing.T) {
-	args := make([]string, 0)
-	c := initialize()
-
-	buf := new(bytes.Buffer)
-	// Testing flag with invalid input
-	c.SetOutput(buf)
-	cmdEcho.AddCommand(cmdTimes)
-	c.AddCommand(cmdPrint, cmdEcho)
-	c.SetArgs(args)
-
-	c.Execute()
-
-	if !strings.Contains(buf.String(), cmdRootNoRun.Long) {
-		t.Errorf("Expected to get help output, Got: \n %s", buf)
-	}
-}
-
-func TestRootNoCommandHelp(t *testing.T) {
-	x := rootOnlySetupTest("--help")
-
-	checkResultOmits(t, x, "Available Commands:")
-	checkResultOmits(t, x, "for more information about a command")
-
-	if strings.Contains(x.Output, "unknown flag: --help") {
-		t.Errorf("--help shouldn't trigger an error, Got: \n %s", x.Output)
-	}
-
-	x = rootOnlySetupTest("echo --help")
-
-	checkResultOmits(t, x, "Available Commands:")
-	checkResultOmits(t, x, "for more information about a command")
-
-	if strings.Contains(x.Output, "unknown flag: --help") {
-		t.Errorf("--help shouldn't trigger an error, Got: \n %s", x.Output)
-	}
-}
-
-func TestRootUnknownCommand(t *testing.T) {
-	r := noRRSetupTest("bogus")
-	s := "Error: unknown command \"bogus\"\nRun 'cobra-test help' for usage.\n"
-
-	if r.Output != s {
-		t.Errorf("Unexpected response.\nExpecting to be:\n %q\nGot:\n %q\n", s, r.Output)
-	}
-}
-
-func TestFlagsBeforeCommand(t *testing.T) {
-	// short without space
-	x := fullSetupTest("-i10 echo")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-	}
-
-	// short (int) with equals
-	// It appears that pflags doesn't support this...
-	// Commenting out until support can be added
-
-	//x = noRRSetupTest("echo -i=10")
-	//if x.Error != nil {
-	//t.Errorf("Valid Input shouldn't have errors, got:\n %s", x.Error)
-	//}
-
-	// long with equals
-	x = noRRSetupTest("--intone=123 echo one two")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %s", x.Error)
-	}
-
-	// With parsing error properly reported
-	x = fullSetupTest("-i10E echo")
-	if !strings.Contains(x.Output, "invalid argument \"10E\" for i10E") {
-		t.Errorf("Wrong error message displayed, \n %s", x.Output)
-	}
-
-	//With quotes
-	x = fullSetupTest("-s=\"walking\" echo")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-	}
-
-	//With quotes and space
-	x = fullSetupTest("-s=\"walking fast\" echo")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-	}
-
-	//With inner quote
-	x = fullSetupTest("-s=\"walking \\\"Inner Quote\\\" fast\" echo")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-	}
-
-	//With quotes and space
-	x = fullSetupTest("-s=\"walking \\\"Inner Quote\\\" fast\" echo")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-	}
-
-}
-
-func TestRemoveCommand(t *testing.T) {
-	versionUsed = 0
-	c := initializeWithRootCmd()
-	c.AddCommand(cmdVersion1)
-	c.RemoveCommand(cmdVersion1)
-	x := fullTester(c, "version")
-	if x.Error == nil {
-		t.Errorf("Removed command should not have been called\n")
-		return
-	}
-}
-
-func TestCommandWithoutSubcommands(t *testing.T) {
-	c := initializeWithRootCmd()
-
-	x := simpleTester(c, "")
-	if x.Error != nil {
-		t.Errorf("Calling command without subcommands should not have error: %v", x.Error)
-		return
-	}
-}
-
-func TestCommandWithoutSubcommandsWithArg(t *testing.T) {
-	c := initializeWithRootCmd()
-	expectedArgs := []string{"arg"}
-
-	x := simpleTester(c, "arg")
-	if x.Error != nil {
-		t.Errorf("Calling command without subcommands but with arg should not have error: %v", x.Error)
-		return
-	}
-	if !reflect.DeepEqual(expectedArgs, tr) {
-		t.Errorf("Calling command without subcommands but with arg has wrong args: expected: %v, actual: %v", expectedArgs, tr)
-		return
-	}
-}
-
-func TestReplaceCommandWithRemove(t *testing.T) {
-	versionUsed = 0
-	c := initializeWithRootCmd()
-	c.AddCommand(cmdVersion1)
-	c.RemoveCommand(cmdVersion1)
-	c.AddCommand(cmdVersion2)
-	x := fullTester(c, "version")
-	if x.Error != nil {
-		t.Errorf("Valid Input shouldn't have errors, got:\n %q", x.Error)
-		return
-	}
-	if versionUsed == 1 {
-		t.Errorf("Removed command shouldn't be called\n")
-	}
-	if versionUsed != 2 {
-		t.Errorf("Replacing command should have been called but didn't\n")
-	}
-}
-
-func TestDeprecatedSub(t *testing.T) {
-	c := fullSetupTest("deprecated")
-
-	checkResultContains(t, c, cmdDeprecated.Deprecated)
-}
-
-func TestPreRun(t *testing.T) {
-	noRRSetupTest("echo one two")
-	if echoPre == nil || echoPersPre == nil {
-		t.Error("PreRun or PersistentPreRun not called")
-	}
-	if rootPersPre != nil || timesPersPre != nil {
-		t.Error("Wrong *Pre functions called!")
-	}
-
-	noRRSetupTest("echo times one two")
-	if timesPersPre == nil {
-		t.Error("PreRun or PersistentPreRun not called")
-	}
-	if echoPre != nil || echoPersPre != nil || rootPersPre != nil {
-		t.Error("Wrong *Pre functions called!")
-	}
-
-	noRRSetupTest("print one two")
-	if rootPersPre == nil {
-		t.Error("Parent PersistentPreRun not called but should not have been")
-	}
-	if echoPre != nil || echoPersPre != nil || timesPersPre != nil {
-		t.Error("Wrong *Pre functions called!")
-	}
-}
-
-// Check if cmdEchoSub gets PersistentPreRun from rootCmd even if is added last
-func TestPeristentPreRunPropagation(t *testing.T) {
-	rootCmd := initialize()
-
-	// First add the cmdEchoSub to cmdPrint
-	cmdPrint.AddCommand(cmdEchoSub)
-	// Now add cmdPrint to rootCmd
-	rootCmd.AddCommand(cmdPrint)
-
-	rootCmd.SetArgs(strings.Split("print echosub lala", " "))
-	rootCmd.Execute()
-
-	if rootPersPre == nil || len(rootPersPre) == 0 || rootPersPre[0] != "lala" {
-		t.Error("RootCmd PersistentPreRun not called but should have been")
-	}
-}
-
-func TestGlobalNormFuncPropagation(t *testing.T) {
-	normFunc := func(f *pflag.FlagSet, name string) pflag.NormalizedName {
-		return pflag.NormalizedName(name)
-	}
-
-	rootCmd := initialize()
-	rootCmd.SetGlobalNormalizationFunc(normFunc)
-	if reflect.ValueOf(normFunc) != reflect.ValueOf(rootCmd.GlobalNormalizationFunc()) {
-		t.Error("rootCmd seems to have a wrong normalization function")
-	}
-
-	// First add the cmdEchoSub to cmdPrint
-	cmdPrint.AddCommand(cmdEchoSub)
-	if cmdPrint.GlobalNormalizationFunc() != nil && cmdEchoSub.GlobalNormalizationFunc() != nil {
-		t.Error("cmdPrint and cmdEchoSub should had no normalization functions")
-	}
-
-	// Now add cmdPrint to rootCmd
-	rootCmd.AddCommand(cmdPrint)
-	if reflect.ValueOf(cmdPrint.GlobalNormalizationFunc()).Pointer() != reflect.ValueOf(rootCmd.GlobalNormalizationFunc()).Pointer() ||
-		reflect.ValueOf(cmdEchoSub.GlobalNormalizationFunc()).Pointer() != reflect.ValueOf(rootCmd.GlobalNormalizationFunc()).Pointer() {
-		t.Error("cmdPrint and cmdEchoSub should had the normalization function of rootCmd")
-	}
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/command.go b/Godeps/_workspace/src/github.com/spf13/cobra/command.go
index 3831c3376b..c1873ec7f8 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/command.go
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/command.go
@@ -39,6 +39,8 @@ type Command struct {
 	Use string
 	// An array of aliases that can be used instead of the first word in Use.
 	Aliases []string
+	// An array of command names for which this command will be suggested - similar to aliases but only suggests.
+	SuggestFor []string
 	// The short description shown in the 'help' output.
 	Short string
 	// The long message shown in the 'help <this-command>' output.
@@ -51,12 +53,18 @@ type Command struct {
 	BashCompletionFunction string
 	// Is this command deprecated and should print this string when used?
 	Deprecated string
+	// Is this command hidden and should NOT show up in the list of available commands?
+	Hidden bool
 	// Full set of flags
 	flags *flag.FlagSet
 	// Set of flags childrens of this command will inherit
 	pflags *flag.FlagSet
 	// Flags that are declared specifically by this command (not inherited).
 	lflags *flag.FlagSet
+	// SilenceErrors is an option to quiet errors down stream
+	SilenceErrors bool
+	// Silence Usage is an option to silence usage when an error occurs.
+	SilenceUsage bool
 	// The *Run functions are executed in the following order:
 	//   * PersistentPreRun()
 	//   * PreRun()
@@ -66,14 +74,24 @@ type Command struct {
 	// All functions get the same args, the arguments after the command name
 	// PersistentPreRun: children of this command will inherit and execute
 	PersistentPreRun func(cmd *Command, args []string)
+	// PersistentPreRunE: PersistentPreRun but returns an error
+	PersistentPreRunE func(cmd *Command, args []string) error
 	// PreRun: children of this command will not inherit.
 	PreRun func(cmd *Command, args []string)
+	// PreRunE: PreRun but returns an error
+	PreRunE func(cmd *Command, args []string) error
 	// Run: Typically the actual work function. Most commands will only implement this
 	Run func(cmd *Command, args []string)
+	// RunE: Run but returns an error
+	RunE func(cmd *Command, args []string) error
 	// PostRun: run after the Run command.
 	PostRun func(cmd *Command, args []string)
+	// PostRunE: PostRun but returns an error
+	PostRunE func(cmd *Command, args []string) error
 	// PersistentPostRun: children of this command will inherit and execute after PostRun
 	PersistentPostRun func(cmd *Command, args []string)
+	// PersistentPostRunE: PersistentPostRun but returns an error
+	PersistentPostRunE func(cmd *Command, args []string) error
 	// Commands is the list of commands supported by this program.
 	commands []*Command
 	// Parent Command for this command
@@ -84,7 +102,6 @@ type Command struct {
 	commandsMaxNameLen        int
 
 	flagErrorBuf *bytes.Buffer
-	cmdErrorBuf  *bytes.Buffer
 
 	args          []string                 // actual args parsed from flags
 	output        *io.Writer               // nil means stderr; use Out() method instead
@@ -93,9 +110,13 @@ type Command struct {
 	helpTemplate  string                   // Can be defined by Application
 	helpFunc      func(*Command, []string) // Help can be defined by application
 	helpCommand   *Command                 // The help command
-	helpFlagVal   bool
 	// The global normalization function that we can use on every pFlag set and children commands
 	globNormFunc func(f *flag.FlagSet, name string) flag.NormalizedName
+
+	// Disable the suggestions based on Levenshtein distance that go along with 'unknown command' messages
+	DisableSuggestions bool
+	// If displaying suggestions, allows to set the minimum levenshtein distance to display, must be > 0
+	SuggestionsMinimumDistance int
 }
 
 // os.Args[1:] by default, if desired, can be overridden
@@ -159,7 +180,6 @@ func (c *Command) SetHelpTemplate(s string) {
 func (c *Command) SetGlobalNormalizationFunc(n func(f *flag.FlagSet, name string) flag.NormalizedName) {
 	c.Flags().SetNormalizeFunc(n)
 	c.PersistentFlags().SetNormalizeFunc(n)
-	c.LocalFlags().SetNormalizeFunc(n)
 	c.globNormFunc = n
 
 	for _, command := range c.commands {
@@ -177,36 +197,28 @@ func (c *Command) UsageFunc() (f func(*Command) error) {
 	} else {
 		return func(c *Command) error {
 			err := tmpl(c.Out(), c.UsageTemplate(), c)
+			if err != nil {
+				fmt.Print(err)
+			}
 			return err
 		}
 	}
 }
+
+// HelpFunc returns either the function set by SetHelpFunc for this command
+// or a parent, or it returns a function which calls c.Help()
 func (c *Command) HelpFunc() func(*Command, []string) {
-	if c.helpFunc != nil {
-		return c.helpFunc
+	cmd := c
+	for cmd != nil {
+		if cmd.helpFunc != nil {
+			return cmd.helpFunc
+		}
+		cmd = cmd.parent
 	}
-
-	if c.HasParent() {
-		return c.parent.HelpFunc()
-	} else {
-		return func(c *Command, args []string) {
-			if len(args) == 0 {
-				// Help called without any topic, calling on root
-				c.Root().Help()
-				return
-			}
-
-			cmd, _, e := c.Root().Find(args)
-			if cmd == nil || e != nil {
-				c.Printf("Unknown help topic %#q.", args)
-
-				c.Root().Usage()
-			} else {
-				err := cmd.Help()
-				if err != nil {
-					c.Println(err)
-				}
-			}
+	return func(*Command, []string) {
+		err := c.Help()
+		if err != nil {
+			c.Println(err)
 		}
 	}
 }
@@ -250,8 +262,7 @@ func (c *Command) UsageTemplate() string {
 	if c.HasParent() {
 		return c.parent.UsageTemplate()
 	} else {
-		return `{{ $cmd := . }}
-Usage: {{if .Runnable}}
+		return `Usage:{{if .Runnable}}
   {{.UseLine}}{{if .HasFlags}} [flags]{{end}}{{end}}{{if .HasSubCommands}}
   {{ .CommandPath}} [command]{{end}}{{if gt .Aliases 0}}
 
@@ -260,22 +271,22 @@ Aliases:
 {{end}}{{if .HasExample}}
 
 Examples:
-{{ .Example }}
-{{end}}{{ if .HasRunnableSubCommands}}
+{{ .Example }}{{end}}{{ if .HasAvailableSubCommands}}
 
-Available Commands: {{range .Commands}}{{if and (.Runnable) (not .Deprecated)}}
-  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}
-{{end}}
-{{ if .HasLocalFlags}}Flags:
-{{.LocalFlags.FlagUsages}}{{end}}
-{{ if .HasInheritedFlags}}Global Flags:
-{{.InheritedFlags.FlagUsages}}{{end}}{{if or (.HasHelpSubCommands) (.HasRunnableSiblings)}}
-Additional help topics:
-{{if .HasHelpSubCommands}}{{range .Commands}}{{if and (not .Runnable) (not .Deprecated)}} {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasRunnableSiblings }}{{range .Parent.Commands}}{{if and (not .Runnable) (not .Deprecated)}}{{if not (eq .Name $cmd.Name) }}
-  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{end}}
-{{end}}{{ if .HasSubCommands }}
-Use "{{.Root.Name}} help [command]" for more information about a command.
-{{end}}`
+Available Commands:{{range .Commands}}{{if .IsAvailableCommand}}
+  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{ if .HasLocalFlags}}
+
+Flags:
+{{.LocalFlags.FlagUsages | trimRightSpace}}{{end}}{{ if .HasInheritedFlags}}
+
+Global Flags:
+{{.InheritedFlags.FlagUsages | trimRightSpace}}{{end}}{{if .HasHelpSubCommands}}
+
+Additional help topics:{{range .Commands}}{{if .IsHelpCommand}}
+  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{ if .HasSubCommands }}
+
+Use "{{.CommandPath}} [command] --help" for more information about a command.{{end}}
+`
 	}
 }
 
@@ -287,9 +298,9 @@ func (c *Command) HelpTemplate() string {
 	if c.HasParent() {
 		return c.parent.HelpTemplate()
 	} else {
-		return `{{with or .Long .Short }}{{. | trim}}{{end}}
-{{if or .Runnable .HasSubCommands}}{{.UsageString}}{{end}}
-`
+		return `{{with or .Long .Short }}{{. | trim}}
+
+{{end}}{{if or .Runnable .HasSubCommands}}{{.UsageString}}{{end}}`
 	}
 }
 
@@ -381,55 +392,87 @@ func (c *Command) Find(args []string) (*Command, []string, error) {
 		return nil, nil, fmt.Errorf("Called find() on a nil Command")
 	}
 
-	// If there are no arguments, return the root command. If the root has no
-	// subcommands, args reflects arguments that should actually be passed to
-	// the root command, so also return the root command.
-	if len(args) == 0 || !c.Root().HasSubCommands() {
-		return c.Root(), args, nil
-	}
-
 	var innerfind func(*Command, []string) (*Command, []string)
 
 	innerfind = func(c *Command, innerArgs []string) (*Command, []string) {
-		if len(innerArgs) > 0 && c.HasSubCommands() {
-			argsWOflags := stripFlags(innerArgs, c)
-			if len(argsWOflags) > 0 {
-				matches := make([]*Command, 0)
-				for _, cmd := range c.commands {
-					if cmd.Name() == argsWOflags[0] || cmd.HasAlias(argsWOflags[0]) { // exact name or alias match
-						return innerfind(cmd, argsMinusFirstX(innerArgs, argsWOflags[0]))
-					} else if EnablePrefixMatching {
-						if strings.HasPrefix(cmd.Name(), argsWOflags[0]) { // prefix match
-							matches = append(matches, cmd)
-						}
-						for _, x := range cmd.Aliases {
-							if strings.HasPrefix(x, argsWOflags[0]) {
-								matches = append(matches, cmd)
-							}
-						}
+		argsWOflags := stripFlags(innerArgs, c)
+		if len(argsWOflags) == 0 {
+			return c, innerArgs
+		}
+		nextSubCmd := argsWOflags[0]
+		matches := make([]*Command, 0)
+		for _, cmd := range c.commands {
+			if cmd.Name() == nextSubCmd || cmd.HasAlias(nextSubCmd) { // exact name or alias match
+				return innerfind(cmd, argsMinusFirstX(innerArgs, nextSubCmd))
+			}
+			if EnablePrefixMatching {
+				if strings.HasPrefix(cmd.Name(), nextSubCmd) { // prefix match
+					matches = append(matches, cmd)
+				}
+				for _, x := range cmd.Aliases {
+					if strings.HasPrefix(x, nextSubCmd) {
+						matches = append(matches, cmd)
 					}
 				}
-
-				// only accept a single prefix match - multiple matches would be ambiguous
-				if len(matches) == 1 {
-					return innerfind(matches[0], argsMinusFirstX(innerArgs, argsWOflags[0]))
-				}
 			}
 		}
 
+		// only accept a single prefix match - multiple matches would be ambiguous
+		if len(matches) == 1 {
+			return innerfind(matches[0], argsMinusFirstX(innerArgs, argsWOflags[0]))
+		}
+
 		return c, innerArgs
 	}
 
 	commandFound, a := innerfind(c, args)
+	argsWOflags := stripFlags(a, commandFound)
 
-	// If we matched on the root, but we asked for a subcommand, return an error
-	if commandFound.Name() == c.Name() && len(stripFlags(args, c)) > 0 && commandFound.Name() != args[0] {
-		return nil, a, fmt.Errorf("unknown command %q", a[0])
+	// no subcommand, always take args
+	if !commandFound.HasSubCommands() {
+		return commandFound, a, nil
+	}
+
+	// root command with subcommands, do subcommand checking
+	if commandFound == c && len(argsWOflags) > 0 {
+		suggestionsString := ""
+		if !c.DisableSuggestions {
+			if c.SuggestionsMinimumDistance <= 0 {
+				c.SuggestionsMinimumDistance = 2
+			}
+			if suggestions := c.SuggestionsFor(argsWOflags[0]); len(suggestions) > 0 {
+				suggestionsString += "\n\nDid you mean this?\n"
+				for _, s := range suggestions {
+					suggestionsString += fmt.Sprintf("\t%v\n", s)
+				}
+			}
+		}
+		return commandFound, a, fmt.Errorf("unknown command %q for %q%s", argsWOflags[0], commandFound.CommandPath(), suggestionsString)
 	}
 
 	return commandFound, a, nil
 }
 
+func (c *Command) SuggestionsFor(typedName string) []string {
+	suggestions := []string{}
+	for _, cmd := range c.commands {
+		if cmd.IsAvailableCommand() {
+			levenshteinDistance := ld(typedName, cmd.Name(), true)
+			suggestByLevenshtein := levenshteinDistance <= c.SuggestionsMinimumDistance
+			suggestByPrefix := strings.HasPrefix(strings.ToLower(cmd.Name()), strings.ToLower(typedName))
+			if suggestByLevenshtein || suggestByPrefix {
+				suggestions = append(suggestions, cmd.Name())
+			}
+			for _, explicitSuggestion := range cmd.SuggestFor {
+				if strings.EqualFold(typedName, explicitSuggestion) {
+					suggestions = append(suggestions, cmd.Name())
+				}
+			}
+		}
+	}
+	return suggestions
+}
+
 func (c *Command) Root() *Command {
 	var findRoot func(*Command) *Command
 
@@ -444,6 +487,14 @@ func (c *Command) Root() *Command {
 	return findRoot(c)
 }
 
+// ArgsLenAtDash will return the length of f.Args at the moment when a -- was
+// found during arg parsing. This allows your program to know which args were
+// before the -- and which came after. (Description from
+// https://godoc.org/github.com/spf13/pflag#FlagSet.ArgsLenAtDash).
+func (c *Command) ArgsLenAtDash() int {
+	return c.Flags().ArgsLenAtDash()
+}
+
 func (c *Command) execute(a []string) (err error) {
 	if c == nil {
 		return fmt.Errorf("Called Execute() on a nil Command")
@@ -453,52 +504,70 @@ func (c *Command) execute(a []string) (err error) {
 		c.Printf("Command %q is deprecated, %s\n", c.Name(), c.Deprecated)
 	}
 
+	// initialize help flag as the last point possible to allow for user
+	// overriding
+	c.initHelpFlag()
+
 	err = c.ParseFlags(a)
-	if err == flag.ErrHelp {
-		c.Help()
-		return nil
-	}
 	if err != nil {
-		// We're writing subcommand usage to root command's error buffer to have it displayed to the user
-		r := c.Root()
-		if r.cmdErrorBuf == nil {
-			r.cmdErrorBuf = new(bytes.Buffer)
-		}
-		// for writing the usage to the buffer we need to switch the output temporarily
-		// since Out() returns root output, you also need to revert that on root
-		out := r.Out()
-		r.SetOutput(r.cmdErrorBuf)
-		c.Usage()
-		r.SetOutput(out)
 		return err
 	}
-	// If help is called, regardless of other flags, we print that.
-	// Print help also if c.Run is nil.
-	if c.helpFlagVal || !c.Runnable() {
-		c.Help()
-		return nil
+	// If help is called, regardless of other flags, return we want help
+	// Also say we need help if the command isn't runnable.
+	helpVal, err := c.Flags().GetBool("help")
+	if err != nil {
+		// should be impossible to get here as we always declare a help
+		// flag in initHelpFlag()
+		c.Println("\"help\" flag declared as non-bool. Please correct your code")
+		return err
+	}
+	if helpVal || !c.Runnable() {
+		return flag.ErrHelp
 	}
 
 	c.preRun()
 	argWoFlags := c.Flags().Args()
 
 	for p := c; p != nil; p = p.Parent() {
-		if p.PersistentPreRun != nil {
+		if p.PersistentPreRunE != nil {
+			if err := p.PersistentPreRunE(c, argWoFlags); err != nil {
+				return err
+			}
+			break
+		} else if p.PersistentPreRun != nil {
 			p.PersistentPreRun(c, argWoFlags)
 			break
 		}
 	}
-	if c.PreRun != nil {
+	if c.PreRunE != nil {
+		if err := c.PreRunE(c, argWoFlags); err != nil {
+			return err
+		}
+	} else if c.PreRun != nil {
 		c.PreRun(c, argWoFlags)
 	}
 
-	c.Run(c, argWoFlags)
-
-	if c.PostRun != nil {
+	if c.RunE != nil {
+		if err := c.RunE(c, argWoFlags); err != nil {
+			return err
+		}
+	} else {
+		c.Run(c, argWoFlags)
+	}
+	if c.PostRunE != nil {
+		if err := c.PostRunE(c, argWoFlags); err != nil {
+			return err
+		}
+	} else if c.PostRun != nil {
 		c.PostRun(c, argWoFlags)
 	}
 	for p := c; p != nil; p = p.Parent() {
-		if p.PersistentPostRun != nil {
+		if p.PersistentPostRunE != nil {
+			if err := p.PersistentPostRunE(c, argWoFlags); err != nil {
+				return err
+			}
+			break
+		} else if p.PersistentPostRun != nil {
 			p.PersistentPostRun(c, argWoFlags)
 			break
 		}
@@ -545,7 +614,7 @@ func (c *Command) Execute() (err error) {
 
 	// initialize help as the last point possible to allow for user
 	// overriding
-	c.initHelp()
+	c.initHelpCmd()
 
 	var args []string
 
@@ -556,24 +625,47 @@ func (c *Command) Execute() (err error) {
 	}
 
 	cmd, flags, err := c.Find(args)
-	if err == nil {
-		err = cmd.execute(flags)
-	}
-
 	if err != nil {
-		if err == flag.ErrHelp {
-			c.Help()
-
-		} else {
-			c.Println("Error:", err.Error())
-			c.Printf("Run '%v help' for usage.\n", c.Root().Name())
+		// If found parse to a subcommand and then failed, talk about the subcommand
+		if cmd != nil {
+			c = cmd
 		}
+		if !c.SilenceErrors {
+			c.Println("Error:", err.Error())
+			c.Printf("Run '%v --help' for usage.\n", c.CommandPath())
+		}
+		return err
 	}
 
+	err = cmd.execute(flags)
+	if err != nil {
+		// If root command has SilentErrors flagged,
+		// all subcommands should respect it
+		if !cmd.SilenceErrors && !c.SilenceErrors {
+			if err == flag.ErrHelp {
+				cmd.HelpFunc()(cmd, args)
+				return nil
+			}
+			c.Println("Error:", err.Error())
+		}
+
+		// If root command has SilentUsage flagged,
+		// all subcommands should respect it
+		if !cmd.SilenceUsage && !c.SilenceUsage {
+			c.Println(cmd.UsageString())
+		}
+		return err
+	}
 	return
 }
 
-func (c *Command) initHelp() {
+func (c *Command) initHelpFlag() {
+	if c.Flags().Lookup("help") == nil {
+		c.Flags().BoolP("help", "h", false, "help for "+c.Name())
+	}
+}
+
+func (c *Command) initHelpCmd() {
 	if c.helpCommand == nil {
 		if !c.HasSubCommands() {
 			return
@@ -584,9 +676,19 @@ func (c *Command) initHelp() {
 			Short: "Help about any command",
 			Long: `Help provides help for any command in the application.
     Simply type ` + c.Name() + ` help [path to command] for full details.`,
-			Run:               c.HelpFunc(),
 			PersistentPreRun:  func(cmd *Command, args []string) {},
 			PersistentPostRun: func(cmd *Command, args []string) {},
+
+			Run: func(c *Command, args []string) {
+				cmd, _, e := c.Root().Find(args)
+				if cmd == nil || e != nil {
+					c.Printf("Unknown help topic %#q.", args)
+					c.Root().Usage()
+				} else {
+					helpFunc := cmd.HelpFunc()
+					helpFunc(cmd, args)
+				}
+			},
 		}
 	}
 	c.AddCommand(c.helpCommand)
@@ -596,8 +698,6 @@ func (c *Command) initHelp() {
 func (c *Command) ResetCommands() {
 	c.commands = nil
 	c.helpCommand = nil
-	c.cmdErrorBuf = new(bytes.Buffer)
-	c.cmdErrorBuf.Reset()
 }
 
 //Commands returns a slice of child commands.
@@ -809,7 +909,7 @@ func (c *Command) HasExample() bool {
 
 // Determine if the command is itself runnable
 func (c *Command) Runnable() bool {
-	return c.Run != nil
+	return c.Run != nil || c.RunE != nil
 }
 
 // Determine if the command has children commands
@@ -817,34 +917,75 @@ func (c *Command) HasSubCommands() bool {
 	return len(c.commands) > 0
 }
 
-func (c *Command) HasRunnableSiblings() bool {
-	if !c.HasParent() {
+// IsAvailableCommand determines if a command is available as a non-help command
+// (this includes all non deprecated/hidden commands)
+func (c *Command) IsAvailableCommand() bool {
+	if len(c.Deprecated) != 0 || c.Hidden {
 		return false
 	}
-	for _, sub := range c.parent.commands {
-		if sub.Runnable() {
-			return true
-		}
+
+	if c.HasParent() && c.Parent().helpCommand == c {
+		return false
 	}
+
+	if c.Runnable() || c.HasAvailableSubCommands() {
+		return true
+	}
+
 	return false
 }
 
+// IsHelpCommand determines if a command is a 'help' command; a help command is
+// determined by the fact that it is NOT runnable/hidden/deprecated, and has no
+// sub commands that are runnable/hidden/deprecated
+func (c *Command) IsHelpCommand() bool {
+
+	// if a command is runnable, deprecated, or hidden it is not a 'help' command
+	if c.Runnable() || len(c.Deprecated) != 0 || c.Hidden {
+		return false
+	}
+
+	// if any non-help sub commands are found, the command is not a 'help' command
+	for _, sub := range c.commands {
+		if !sub.IsHelpCommand() {
+			return false
+		}
+	}
+
+	// the command either has no sub commands, or no non-help sub commands
+	return true
+}
+
+// HasHelpSubCommands determines if a command has any avilable 'help' sub commands
+// that need to be shown in the usage/help default template under 'additional help
+// topics'
 func (c *Command) HasHelpSubCommands() bool {
+
+	// return true on the first found available 'help' sub command
 	for _, sub := range c.commands {
-		if !sub.Runnable() {
+		if sub.IsHelpCommand() {
 			return true
 		}
 	}
+
+	// the command either has no sub commands, or no available 'help' sub commands
 	return false
 }
 
-// Determine if the command has runnable children commands
-func (c *Command) HasRunnableSubCommands() bool {
+// HasAvailableSubCommands determines if a command has available sub commands that
+// need to be shown in the usage/help default template under 'available commands'
+func (c *Command) HasAvailableSubCommands() bool {
+
+	// return true on the first found available (non deprecated/help/hidden)
+	// sub command
 	for _, sub := range c.commands {
-		if sub.Runnable() {
+		if sub.IsAvailableCommand() {
 			return true
 		}
 	}
+
+	// the command either has no sub comamnds, or no available (non deprecated/help/hidden)
+	// sub commands
 	return false
 }
 
@@ -866,7 +1007,6 @@ func (c *Command) Flags() *flag.FlagSet {
 			c.flagErrorBuf = new(bytes.Buffer)
 		}
 		c.flags.SetOutput(c.flagErrorBuf)
-		c.PersistentFlags().BoolVarP(&c.helpFlagVal, "help", "h", false, "help for "+c.Name())
 	}
 	return c.flags
 }
@@ -879,6 +1019,13 @@ func (c *Command) LocalFlags() *flag.FlagSet {
 	c.lflags.VisitAll(func(f *flag.Flag) {
 		local.AddFlag(f)
 	})
+	if !c.HasParent() {
+		flag.CommandLine.VisitAll(func(f *flag.Flag) {
+			if local.Lookup(f.Name) == nil {
+				local.AddFlag(f)
+			}
+		})
+	}
 	return local
 }
 
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/command_test.go b/Godeps/_workspace/src/github.com/spf13/cobra/command_test.go
deleted file mode 100644
index 477d84e7c8..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/cobra/command_test.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package cobra
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestStripFlags(t *testing.T) {
-	tests := []struct {
-		input  []string
-		output []string
-	}{
-		{
-			[]string{"foo", "bar"},
-			[]string{"foo", "bar"},
-		},
-		{
-			[]string{"foo", "--bar", "-b"},
-			[]string{"foo"},
-		},
-		{
-			[]string{"-b", "foo", "--bar", "bar"},
-			[]string{},
-		},
-		{
-			[]string{"-i10", "echo"},
-			[]string{"echo"},
-		},
-		{
-			[]string{"-i=10", "echo"},
-			[]string{"echo"},
-		},
-		{
-			[]string{"--int=100", "echo"},
-			[]string{"echo"},
-		},
-		{
-			[]string{"-ib", "echo", "-bfoo", "baz"},
-			[]string{"echo", "baz"},
-		},
-		{
-			[]string{"-i=baz", "bar", "-i", "foo", "blah"},
-			[]string{"bar", "blah"},
-		},
-		{
-			[]string{"--int=baz", "-bbar", "-i", "foo", "blah"},
-			[]string{"blah"},
-		},
-		{
-			[]string{"--cat", "bar", "-i", "foo", "blah"},
-			[]string{"bar", "blah"},
-		},
-		{
-			[]string{"-c", "bar", "-i", "foo", "blah"},
-			[]string{"bar", "blah"},
-		},
-		{
-			[]string{"--persist", "bar"},
-			[]string{"bar"},
-		},
-		{
-			[]string{"-p", "bar"},
-			[]string{"bar"},
-		},
-	}
-
-	cmdPrint := &Command{
-		Use:   "print [string to print]",
-		Short: "Print anything to the screen",
-		Long:  `an utterly useless command for testing.`,
-		Run: func(cmd *Command, args []string) {
-			tp = args
-		},
-	}
-
-	var flagi int
-	var flagstr string
-	var flagbool bool
-	cmdPrint.PersistentFlags().BoolVarP(&flagbool, "persist", "p", false, "help for persistent one")
-	cmdPrint.Flags().IntVarP(&flagi, "int", "i", 345, "help message for flag int")
-	cmdPrint.Flags().StringVarP(&flagstr, "bar", "b", "bar", "help message for flag string")
-	cmdPrint.Flags().BoolVarP(&flagbool, "cat", "c", false, "help message for flag bool")
-
-	for _, test := range tests {
-		output := stripFlags(test.input, cmdPrint)
-		if !reflect.DeepEqual(test.output, output) {
-			t.Errorf("expected: %v, got: %v", test.output, output)
-		}
-	}
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/doc_util.go b/Godeps/_workspace/src/github.com/spf13/cobra/doc_util.go
new file mode 100644
index 0000000000..e248216284
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/doc_util.go
@@ -0,0 +1,34 @@
+// Copyright 2015 Red Hat Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cobra
+
+// Test to see if we have a reason to print See Also information in docs
+// Basically this is a test for a parent commend or a subcommand which is
+// both not deprecated and not the autogenerated help command.
+func (cmd *Command) hasSeeAlso() bool {
+	if cmd.HasParent() {
+		return true
+	}
+	children := cmd.Commands()
+	if len(children) == 0 {
+		return false
+	}
+	for _, c := range children {
+		if !c.IsAvailableCommand() || c == cmd.helpCommand {
+			continue
+		}
+		return true
+	}
+	return false
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.go b/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.go
new file mode 100644
index 0000000000..e61fff1828
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.go
@@ -0,0 +1,213 @@
+// Copyright 2015 Red Hat Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cobra
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	mangen "github.com/cpuguy83/go-md2man/md2man"
+	"github.com/spf13/pflag"
+)
+
+// GenManTree will call cmd.GenManTree(header, dir)
+func GenManTree(cmd *Command, header *GenManHeader, dir string) {
+	cmd.GenManTree(header, dir)
+}
+
+// GenManTree will generate a man page for this command and all decendants
+// in the directory given. The header may be nil. This function may not work
+// correctly if your command names have - in them. If you have `cmd` with two
+// subcmds, `sub` and `sub-third`. And `sub` has a subcommand called `third`
+// it is undefined which help output will be in the file `cmd-sub-third.1`.
+func (cmd *Command) GenManTree(header *GenManHeader, dir string) {
+	if header == nil {
+		header = &GenManHeader{}
+	}
+	for _, c := range cmd.Commands() {
+		if !c.IsAvailableCommand() || c == cmd.helpCommand {
+			continue
+		}
+		GenManTree(c, header, dir)
+	}
+	out := new(bytes.Buffer)
+
+	cmd.GenMan(header, out)
+
+	filename := cmd.CommandPath()
+	filename = dir + strings.Replace(filename, " ", "-", -1) + ".1"
+	outFile, err := os.Create(filename)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	defer outFile.Close()
+	_, err = outFile.Write(out.Bytes())
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
+
+// GenManHeader is a lot like the .TH header at the start of man pages. These
+// include the title, section, date, source, and manual. We will use the
+// current time if Date if unset and will use "Auto generated by spf13/cobra"
+// if the Source is unset.
+type GenManHeader struct {
+	Title   string
+	Section string
+	Date    *time.Time
+	date    string
+	Source  string
+	Manual  string
+}
+
+// GenMan will call cmd.GenMan(header, out)
+func GenMan(cmd *Command, header *GenManHeader, out *bytes.Buffer) {
+	cmd.GenMan(header, out)
+}
+
+// GenMan will generate a man page for the given command in the out buffer.
+// The header argument may be nil, however obviously out may not.
+func (cmd *Command) GenMan(header *GenManHeader, out *bytes.Buffer) {
+	if header == nil {
+		header = &GenManHeader{}
+	}
+	buf := genMarkdown(cmd, header)
+	final := mangen.Render(buf)
+	out.Write(final)
+}
+
+func fillHeader(header *GenManHeader, name string) {
+	if header.Title == "" {
+		header.Title = name
+	}
+	if header.Section == "" {
+		header.Section = "1"
+	}
+	if header.Date == nil {
+		now := time.Now()
+		header.Date = &now
+	}
+	header.date = (*header.Date).Format("Jan 2006")
+	if header.Source == "" {
+		header.Source = "Auto generated by spf13/cobra"
+	}
+}
+
+func manPreamble(out *bytes.Buffer, header *GenManHeader, name, short, long string) {
+	fmt.Fprintf(out, `%% %s(%s)%s
+%% %s
+%% %s
+# NAME
+`, header.Title, header.Section, header.date, header.Source, header.Manual)
+	fmt.Fprintf(out, "%s \\- %s\n\n", name, short)
+	fmt.Fprintf(out, "# SYNOPSIS\n")
+	fmt.Fprintf(out, "**%s** [OPTIONS]\n\n", name)
+	fmt.Fprintf(out, "# DESCRIPTION\n")
+	fmt.Fprintf(out, "%s\n\n", long)
+}
+
+func manPrintFlags(out *bytes.Buffer, flags *pflag.FlagSet) {
+	flags.VisitAll(func(flag *pflag.Flag) {
+		if len(flag.Deprecated) > 0 || flag.Hidden {
+			return
+		}
+		format := ""
+		if len(flag.Shorthand) > 0 {
+			format = "**-%s**, **--%s**"
+		} else {
+			format = "%s**--%s**"
+		}
+		if len(flag.NoOptDefVal) > 0 {
+			format = format + "["
+		}
+		if flag.Value.Type() == "string" {
+			// put quotes on the value
+			format = format + "=%q"
+		} else {
+			format = format + "=%s"
+		}
+		if len(flag.NoOptDefVal) > 0 {
+			format = format + "]"
+		}
+		format = format + "\n\t%s\n\n"
+		fmt.Fprintf(out, format, flag.Shorthand, flag.Name, flag.DefValue, flag.Usage)
+	})
+}
+
+func manPrintOptions(out *bytes.Buffer, command *Command) {
+	flags := command.NonInheritedFlags()
+	if flags.HasFlags() {
+		fmt.Fprintf(out, "# OPTIONS\n")
+		manPrintFlags(out, flags)
+		fmt.Fprintf(out, "\n")
+	}
+	flags = command.InheritedFlags()
+	if flags.HasFlags() {
+		fmt.Fprintf(out, "# OPTIONS INHERITED FROM PARENT COMMANDS\n")
+		manPrintFlags(out, flags)
+		fmt.Fprintf(out, "\n")
+	}
+}
+
+func genMarkdown(cmd *Command, header *GenManHeader) []byte {
+	fillHeader(header, cmd.Name())
+	// something like `rootcmd subcmd1 subcmd2`
+	commandName := cmd.CommandPath()
+	// something like `rootcmd-subcmd1-subcmd2`
+	dashCommandName := strings.Replace(commandName, " ", "-", -1)
+
+	buf := new(bytes.Buffer)
+
+	short := cmd.Short
+	long := cmd.Long
+	if len(long) == 0 {
+		long = short
+	}
+
+	manPreamble(buf, header, commandName, short, long)
+	manPrintOptions(buf, cmd)
+
+	if len(cmd.Example) > 0 {
+		fmt.Fprintf(buf, "# EXAMPLE\n")
+		fmt.Fprintf(buf, "```\n%s\n```\n", cmd.Example)
+	}
+
+	if cmd.hasSeeAlso() {
+		fmt.Fprintf(buf, "# SEE ALSO\n")
+		if cmd.HasParent() {
+			parentPath := cmd.Parent().CommandPath()
+			dashParentPath := strings.Replace(parentPath, " ", "-", -1)
+			fmt.Fprintf(buf, "**%s(%s)**, ", dashParentPath, header.Section)
+		}
+
+		children := cmd.Commands()
+		sort.Sort(byName(children))
+		for _, c := range children {
+			if !c.IsAvailableCommand() || c == cmd.helpCommand {
+				continue
+			}
+			fmt.Fprintf(buf, "**%s-%s(%s)**, ", dashCommandName, c.Name(), header.Section)
+		}
+		fmt.Fprintf(buf, "\n")
+	}
+
+	fmt.Fprintf(buf, "# HISTORY\n%s Auto generated by spf13/cobra\n", header.Date.Format("2-Jan-2006"))
+	return buf.Bytes()
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.md b/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.md
new file mode 100644
index 0000000000..a764099e50
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/man_docs.md
@@ -0,0 +1,25 @@
+# Generating Man Pages For Your Own cobra.Command
+
+Generating bash completions from a cobra command is incredibly easy. An example is as follows:
+
+```go
+package main
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func main() {
+	cmd := &cobra.Command{
+		Use:   "test",
+		Short: "my test program",
+	}
+	header := &cobra.GenManHeader{
+		Title: "MINE",
+		Section: "3",
+	}
+	cmd.GenManTree(header, "/tmp")
+}
+```
+
+That will get you a man page `/tmp/test.1`
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/md_docs.go b/Godeps/_workspace/src/github.com/spf13/cobra/md_docs.go
index 6092c85af6..3c27f7ae69 100644
--- a/Godeps/_workspace/src/github.com/spf13/cobra/md_docs.go
+++ b/Godeps/_workspace/src/github.com/spf13/cobra/md_docs.go
@@ -47,10 +47,18 @@ func (s byName) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
 func (s byName) Less(i, j int) bool { return s[i].Name() < s[j].Name() }
 
 func GenMarkdown(cmd *Command, out *bytes.Buffer) {
-	GenMarkdownCustom(cmd, out, func(s string) string { return s })
+	cmd.GenMarkdown(out)
+}
+
+func (cmd *Command) GenMarkdown(out *bytes.Buffer) {
+	cmd.GenMarkdownCustom(out, func(s string) string { return s })
 }
 
 func GenMarkdownCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string) string) {
+	cmd.GenMarkdownCustom(out, linkHandler)
+}
+
+func (cmd *Command) GenMarkdownCustom(out *bytes.Buffer, linkHandler func(string) string) {
 	name := cmd.CommandPath()
 
 	short := cmd.Short
@@ -75,7 +83,7 @@ func GenMarkdownCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string)
 
 	printOptions(out, cmd, name)
 
-	if len(cmd.Commands()) > 0 || cmd.HasParent() {
+	if cmd.hasSeeAlso() {
 		fmt.Fprintf(out, "### SEE ALSO\n")
 		if cmd.HasParent() {
 			parent := cmd.Parent()
@@ -89,7 +97,7 @@ func GenMarkdownCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string)
 		sort.Sort(byName(children))
 
 		for _, child := range children {
-			if len(child.Deprecated) > 0 {
+			if !child.IsAvailableCommand() || child == cmd.helpCommand {
 				continue
 			}
 			cname := name + " " + child.Name()
@@ -100,22 +108,33 @@ func GenMarkdownCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string)
 		fmt.Fprintf(out, "\n")
 	}
 
-	fmt.Fprintf(out, "###### Auto generated by spf13/cobra at %s\n", time.Now().UTC())
+	fmt.Fprintf(out, "###### Auto generated by spf13/cobra on %s\n", time.Now().Format("2-Jan-2006"))
 }
 
 func GenMarkdownTree(cmd *Command, dir string) {
+	cmd.GenMarkdownTree(dir)
+}
+
+func (cmd *Command) GenMarkdownTree(dir string) {
 	identity := func(s string) string { return s }
 	emptyStr := func(s string) string { return "" }
-	GenMarkdownTreeCustom(cmd, dir, emptyStr, identity)
+	cmd.GenMarkdownTreeCustom(dir, emptyStr, identity)
 }
 
 func GenMarkdownTreeCustom(cmd *Command, dir string, filePrepender func(string) string, linkHandler func(string) string) {
+	cmd.GenMarkdownTreeCustom(dir, filePrepender, linkHandler)
+}
+
+func (cmd *Command) GenMarkdownTreeCustom(dir string, filePrepender func(string) string, linkHandler func(string) string) {
 	for _, c := range cmd.Commands() {
-		GenMarkdownTreeCustom(c, dir, filePrepender, linkHandler)
+		if !c.IsAvailableCommand() || c == cmd.helpCommand {
+			continue
+		}
+		c.GenMarkdownTreeCustom(dir, filePrepender, linkHandler)
 	}
 	out := new(bytes.Buffer)
 
-	GenMarkdownCustom(cmd, out, linkHandler)
+	cmd.GenMarkdownCustom(out, linkHandler)
 
 	filename := cmd.CommandPath()
 	filename = dir + strings.Replace(filename, " ", "_", -1) + ".md"
diff --git a/Godeps/_workspace/src/github.com/spf13/cobra/md_docs_test.go b/Godeps/_workspace/src/github.com/spf13/cobra/md_docs_test.go
deleted file mode 100644
index defc941152..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/cobra/md_docs_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package cobra
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-)
-
-var _ = fmt.Println
-var _ = os.Stderr
-
-func TestGenMdDoc(t *testing.T) {
-	c := initializeWithRootCmd()
-	// Need two commands to run the command alphabetical sort
-	cmdEcho.AddCommand(cmdTimes, cmdEchoSub, cmdDeprecated)
-	c.AddCommand(cmdPrint, cmdEcho)
-	cmdRootWithRun.PersistentFlags().StringVarP(&flags2a, "rootflag", "r", "two", strtwoParentHelp)
-
-	out := new(bytes.Buffer)
-
-	// We generate on s subcommand so we have both subcommands and parents
-	GenMarkdown(cmdEcho, out)
-	found := out.String()
-
-	// Our description
-	expected := cmdEcho.Long
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	// Better have our example
-	expected = cmdEcho.Example
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	// A local flag
-	expected = "boolone"
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	// persistent flag on parent
-	expected = "rootflag"
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	// We better output info about our parent
-	expected = cmdRootWithRun.Short
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	// And about subcommands
-	expected = cmdEchoSub.Short
-	if !strings.Contains(found, expected) {
-		t.Errorf("Unexpected response.\nExpecting to contain: \n %q\nGot:\n %q\n", expected, found)
-	}
-
-	unexpected := cmdDeprecated.Short
-	if strings.Contains(found, unexpected) {
-		t.Errorf("Unexpected response.\nFound: %v\nBut should not have!!\n", unexpected)
-	}
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/.travis.yml b/Godeps/_workspace/src/github.com/spf13/pflag/.travis.yml
index c4d88e3749..df435a03fd 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/.travis.yml
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/.travis.yml
@@ -5,4 +5,14 @@ language: go
 go:
         - 1.3
         - 1.4
+        - 1.5
         - tip
+
+install:
+        - go get github.com/golang/lint/golint
+        - export PATH=$GOPATH/bin:$PATH
+        - go install ./...
+
+script:
+        - verify/all.sh
+        - go test ./...
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/README.md b/Godeps/_workspace/src/github.com/spf13/pflag/README.md
index f7d63500f5..e74dd50b41 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/README.md
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/README.md
@@ -20,11 +20,11 @@ pflag is available using the standard `go get` command.
 
 Install by running:
 
-    go get github.com/ogier/pflag
+    go get github.com/spf13/pflag
 
 Run tests by running:
 
-    go test github.com/ogier/pflag
+    go test github.com/spf13/pflag
 
 ## Usage
 
@@ -33,7 +33,7 @@ pflag under the name "flag" then all code should continue to function
 with no changes.
 
 ``` go
-import flag "github.com/ogier/pflag"
+import flag "github.com/spf13/pflag"
 ```
 
 There is one exception to this: if you directly instantiate the Flag struct
@@ -84,6 +84,16 @@ fmt.Println("ip has value ", *ip)
 fmt.Println("flagvar has value ", flagvar)
 ```
 
+There are helpers function to get values later if you have the FlagSet but
+it was difficult to keep up with all of the the flag pointers in your code.
+If you have a pflag.FlagSet with a flag called 'flagname' of type int you
+can use GetInt() to get the int value. But notice that 'flagname' must exist
+and it must be an int. GetString("flagname") will fail.
+
+``` go
+i, err := flagset.GetInt("flagname")
+```
+
 After parsing, the arguments after the flag are available as the
 slice flag.Args() or individually as flag.Arg(i).
 The arguments are indexed from 0 through flag.NArg()-1.
@@ -111,29 +121,56 @@ in a command-line interface. The methods of FlagSet are
 analogous to the top-level functions for the command-line
 flag set.
 
+## Setting no option default values for flags
+
+After you create a flag it is possible to set the pflag.NoOptDefVal for
+the given flag. Doing this changes the meaning of the flag slightly. If
+a flag has a NoOptDefVal and the flag is set on the command line without
+an option the flag will be set to the NoOptDefVal. For example given:
+
+``` go
+var ip = flag.IntP("flagname", "f", 1234, "help message")
+flag.Lookup("flagname").NoOptDefVal = "4321"
+```
+
+Would result in something like
+
+| Parsed Arguments | Resulting Value |
+| -------------    | -------------   |
+| --flagname=1357  | ip=1357         |
+| --flagname       | ip=4321         |
+| [nothing]        | ip=1234         |
+
 ## Command line flag syntax
 
 ```
---flag    // boolean flags only
+--flag    // boolean flags, or flags with no option default values
+--flag x  // only on flags without a default value
 --flag=x
 ```
 
 Unlike the flag package, a single dash before an option means something
 different than a double dash. Single dashes signify a series of shorthand
-letters for flags. All but the last shorthand letter must be boolean flags.
+letters for flags. All but the last shorthand letter must be boolean flags
+or a flag with a default value
 
 ```
-// boolean flags
+// boolean or flags where the 'no option default value' is set
 -f
+-f=true
 -abc
+but
+-b true is INVALID
 
-// non-boolean flags
+// non-boolean and flags without a 'no option default value'
 -n 1234
--Ifile
+-n=1234
+-n1234
 
 // mixed
 -abcs "hello"
--abcn1234
+-absd="hello"
+-abcs1234
 ```
 
 Flag parsing stops after the terminator "--". Unlike the flag package,
@@ -151,7 +188,7 @@ It is possible to set a custom flag name 'normalization function.' It allows fla
 
 **Example #1**: You want -, _, and . in flags to compare the same. aka --my-flag == --my_flag == --my.flag
 
-```go
+``` go
 func wordSepNormalizeFunc(f *pflag.FlagSet, name string) pflag.NormalizedName {
 	from := []string{"-", "_"}
 	to := "."
@@ -166,7 +203,7 @@ myFlagSet.SetNormalizeFunc(wordSepNormalizeFunc)
 
 **Example #2**: You want to alias two flags. aka --old-flag-name == --new-flag-name
 
-```go
+``` go
 func aliasNormalizeFunc(f *pflag.FlagSet, name string) pflag.NormalizedName {
 	switch name {
 	case "old-flag-name":
@@ -179,6 +216,34 @@ func aliasNormalizeFunc(f *pflag.FlagSet, name string) pflag.NormalizedName {
 myFlagSet.SetNormalizeFunc(aliasNormalizeFunc)
 ```
 
+## Deprecating a flag or its shorthand
+It is possible to deprecate a flag, or just its shorthand. Deprecating a flag/shorthand hides it from help text and prints a usage message when the deprecated flag/shorthand is used.
+
+**Example #1**: You want to deprecate a flag named "badflag" as well as inform the users what flag they should use instead.
+```go
+// deprecate a flag by specifying its name and a usage message
+flags.MarkDeprecated("badflag", "please use --good-flag instead")
+```
+This hides "badflag" from help text, and prints `Flag --badflag has been deprecated, please use --good-flag instead` when "badflag" is used.
+
+**Example #2**: You want to keep a flag name "noshorthandflag" but deprecate its shortname "n".
+```go
+// deprecate a flag shorthand by specifying its flag name and a usage message
+flags.MarkShorthandDeprecated("noshorthandflag", "please use --noshorthandflag only")
+```
+This hides the shortname "n" from help text, and prints `Flag shorthand -n has been deprecated, please use --noshorthandflag only` when the shorthand "n" is used.
+
+Note that usage message is essential here, and it should not be empty.
+
+## Hidden flags
+It is possible to mark a flag as hidden, meaning it will still function as normal, however will not show up in usage/help text.
+
+**Example**: You have a flag named "secretFlag" that you need for internal use only and don't want it showing up in help text, or for its usage text to be available.
+```go
+// hide a flag by specifying its name
+flags.MarkHidden("secretFlag")
+```
+
 ## More info
 
 You can see the full reference documentation of the pflag package
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/bool.go b/Godeps/_workspace/src/github.com/spf13/pflag/bool.go
index 70e2e0a6b9..d272e40bdd 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/bool.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/bool.go
@@ -34,37 +34,50 @@ func (b *boolValue) String() string { return fmt.Sprintf("%v", *b) }
 
 func (b *boolValue) IsBoolFlag() bool { return true }
 
+func boolConv(sval string) (interface{}, error) {
+	return strconv.ParseBool(sval)
+}
+
+// GetBool return the bool value of a flag with the given name
+func (f *FlagSet) GetBool(name string) (bool, error) {
+	val, err := f.getFlagType(name, "bool", boolConv)
+	if err != nil {
+		return false, err
+	}
+	return val.(bool), nil
+}
+
 // BoolVar defines a bool flag with specified name, default value, and usage string.
 // The argument p points to a bool variable in which to store the value of the flag.
 func (f *FlagSet) BoolVar(p *bool, name string, value bool, usage string) {
-	f.VarP(newBoolValue(value, p), name, "", usage)
+	f.BoolVarP(p, name, "", value, usage)
 }
 
-// Like BoolVar, but accepts a shorthand letter that can be used after a single dash.
+// BoolVarP is like BoolVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) BoolVarP(p *bool, name, shorthand string, value bool, usage string) {
-	f.VarP(newBoolValue(value, p), name, shorthand, usage)
+	flag := f.VarPF(newBoolValue(value, p), name, shorthand, usage)
+	flag.NoOptDefVal = "true"
 }
 
 // BoolVar defines a bool flag with specified name, default value, and usage string.
 // The argument p points to a bool variable in which to store the value of the flag.
 func BoolVar(p *bool, name string, value bool, usage string) {
-	CommandLine.VarP(newBoolValue(value, p), name, "", usage)
+	BoolVarP(p, name, "", value, usage)
 }
 
-// Like BoolVar, but accepts a shorthand letter that can be used after a single dash.
+// BoolVarP is like BoolVar, but accepts a shorthand letter that can be used after a single dash.
 func BoolVarP(p *bool, name, shorthand string, value bool, usage string) {
-	CommandLine.VarP(newBoolValue(value, p), name, shorthand, usage)
+	flag := CommandLine.VarPF(newBoolValue(value, p), name, shorthand, usage)
+	flag.NoOptDefVal = "true"
 }
 
 // Bool defines a bool flag with specified name, default value, and usage string.
 // The return value is the address of a bool variable that stores the value of the flag.
 func (f *FlagSet) Bool(name string, value bool, usage string) *bool {
-	p := new(bool)
-	f.BoolVarP(p, name, "", value, usage)
-	return p
+	return f.BoolP(name, "", value, usage)
 }
 
-// Like Bool, but accepts a shorthand letter that can be used after a single dash.
+// BoolP is like Bool, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) BoolP(name, shorthand string, value bool, usage string) *bool {
 	p := new(bool)
 	f.BoolVarP(p, name, shorthand, value, usage)
@@ -74,10 +87,11 @@ func (f *FlagSet) BoolP(name, shorthand string, value bool, usage string) *bool
 // Bool defines a bool flag with specified name, default value, and usage string.
 // The return value is the address of a bool variable that stores the value of the flag.
 func Bool(name string, value bool, usage string) *bool {
-	return CommandLine.BoolP(name, "", value, usage)
+	return BoolP(name, "", value, usage)
 }
 
-// Like Bool, but accepts a shorthand letter that can be used after a single dash.
+// BoolP is like Bool, but accepts a shorthand letter that can be used after a single dash.
 func BoolP(name, shorthand string, value bool, usage string) *bool {
-	return CommandLine.BoolP(name, shorthand, value, usage)
+	b := CommandLine.BoolP(name, shorthand, value, usage)
+	return b
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/bool_test.go b/Godeps/_workspace/src/github.com/spf13/pflag/bool_test.go
deleted file mode 100644
index a2e1c5dccc..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/pflag/bool_test.go
+++ /dev/null
@@ -1,164 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pflag
-
-import (
-	"bytes"
-	"fmt"
-	"strconv"
-	"testing"
-)
-
-// This value can be a boolean ("true", "false") or "maybe"
-type triStateValue int
-
-const (
-	triStateFalse triStateValue = 0
-	triStateTrue  triStateValue = 1
-	triStateMaybe triStateValue = 2
-)
-
-const strTriStateMaybe = "maybe"
-
-func (v *triStateValue) IsBoolFlag() bool {
-	return true
-}
-
-func (v *triStateValue) Get() interface{} {
-	return triStateValue(*v)
-}
-
-func (v *triStateValue) Set(s string) error {
-	if s == strTriStateMaybe {
-		*v = triStateMaybe
-		return nil
-	}
-	boolVal, err := strconv.ParseBool(s)
-	if boolVal {
-		*v = triStateTrue
-	} else {
-		*v = triStateFalse
-	}
-	return err
-}
-
-func (v *triStateValue) String() string {
-	if *v == triStateMaybe {
-		return strTriStateMaybe
-	}
-	return fmt.Sprintf("%v", bool(*v == triStateTrue))
-}
-
-// The type of the flag as requred by the pflag.Value interface
-func (v *triStateValue) Type() string {
-	return "version"
-}
-
-func setUpFlagSet(tristate *triStateValue) *FlagSet {
-	f := NewFlagSet("test", ContinueOnError)
-	*tristate = triStateFalse
-	f.VarP(tristate, "tristate", "t", "tristate value (true, maybe or false)")
-	return f
-}
-
-func TestExplicitTrue(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{"--tristate=true"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateTrue {
-		t.Fatal("expected", triStateTrue, "(triStateTrue) but got", tristate, "instead")
-	}
-}
-
-func TestImplicitTrue(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{"--tristate"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateTrue {
-		t.Fatal("expected", triStateTrue, "(triStateTrue) but got", tristate, "instead")
-	}
-}
-
-func TestShortFlag(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{"-t"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateTrue {
-		t.Fatal("expected", triStateTrue, "(triStateTrue) but got", tristate, "instead")
-	}
-}
-
-func TestShortFlagExtraArgument(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	// The"maybe"turns into an arg, since short boolean options will only do true/false
-	err := f.Parse([]string{"-t", "maybe"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateTrue {
-		t.Fatal("expected", triStateTrue, "(triStateTrue) but got", tristate, "instead")
-	}
-	args := f.Args()
-	if len(args) != 1 || args[0] != "maybe" {
-		t.Fatal("expected an extra 'maybe' argument to stick around")
-	}
-}
-
-func TestExplicitMaybe(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{"--tristate=maybe"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateMaybe {
-		t.Fatal("expected", triStateMaybe, "(triStateMaybe) but got", tristate, "instead")
-	}
-}
-
-func TestExplicitFalse(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{"--tristate=false"})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateFalse {
-		t.Fatal("expected", triStateFalse, "(triStateFalse) but got", tristate, "instead")
-	}
-}
-
-func TestImplicitFalse(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	err := f.Parse([]string{})
-	if err != nil {
-		t.Fatal("expected no error; got", err)
-	}
-	if tristate != triStateFalse {
-		t.Fatal("expected", triStateFalse, "(triStateFalse) but got", tristate, "instead")
-	}
-}
-
-func TestInvalidValue(t *testing.T) {
-	var tristate triStateValue
-	f := setUpFlagSet(&tristate)
-	var buf bytes.Buffer
-	f.SetOutput(&buf)
-	err := f.Parse([]string{"--tristate=invalid"})
-	if err == nil {
-		t.Fatal("expected an error but did not get any, tristate has value", tristate)
-	}
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/count.go b/Godeps/_workspace/src/github.com/spf13/pflag/count.go
new file mode 100644
index 0000000000..7b1f142e78
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/count.go
@@ -0,0 +1,97 @@
+package pflag
+
+import (
+	"fmt"
+	"strconv"
+)
+
+// -- count Value
+type countValue int
+
+func newCountValue(val int, p *int) *countValue {
+	*p = val
+	return (*countValue)(p)
+}
+
+func (i *countValue) Set(s string) error {
+	v, err := strconv.ParseInt(s, 0, 64)
+	// -1 means that no specific value was passed, so increment
+	if v == -1 {
+		*i = countValue(*i + 1)
+	} else {
+		*i = countValue(v)
+	}
+	return err
+}
+
+func (i *countValue) Type() string {
+	return "count"
+}
+
+func (i *countValue) String() string { return fmt.Sprintf("%v", *i) }
+
+func countConv(sval string) (interface{}, error) {
+	i, err := strconv.Atoi(sval)
+	if err != nil {
+		return nil, err
+	}
+	return i, nil
+}
+
+// GetCount return the int value of a flag with the given name
+func (f *FlagSet) GetCount(name string) (int, error) {
+	val, err := f.getFlagType(name, "count", countConv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(int), nil
+}
+
+// CountVar defines a count flag with specified name, default value, and usage string.
+// The argument p points to an int variable in which to store the value of the flag.
+// A count flag will add 1 to its value evey time it is found on the command line
+func (f *FlagSet) CountVar(p *int, name string, usage string) {
+	f.CountVarP(p, name, "", usage)
+}
+
+// CountVarP is like CountVar only take a shorthand for the flag name.
+func (f *FlagSet) CountVarP(p *int, name, shorthand string, usage string) {
+	flag := f.VarPF(newCountValue(0, p), name, shorthand, usage)
+	flag.NoOptDefVal = "-1"
+}
+
+// CountVar like CountVar only the flag is placed on the CommandLine instead of a given flag set
+func CountVar(p *int, name string, usage string) {
+	CommandLine.CountVar(p, name, usage)
+}
+
+// CountVarP is like CountVar only take a shorthand for the flag name.
+func CountVarP(p *int, name, shorthand string, usage string) {
+	CommandLine.CountVarP(p, name, shorthand, usage)
+}
+
+// Count defines a count flag with specified name, default value, and usage string.
+// The return value is the address of an int variable that stores the value of the flag.
+// A count flag will add 1 to its value evey time it is found on the command line
+func (f *FlagSet) Count(name string, usage string) *int {
+	p := new(int)
+	f.CountVarP(p, name, "", usage)
+	return p
+}
+
+// CountP is like Count only takes a shorthand for the flag name.
+func (f *FlagSet) CountP(name, shorthand string, usage string) *int {
+	p := new(int)
+	f.CountVarP(p, name, shorthand, usage)
+	return p
+}
+
+// Count like Count only the flag is placed on the CommandLine isntead of a given flag set
+func Count(name string, usage string) *int {
+	return CommandLine.CountP(name, "", usage)
+}
+
+// CountP is like Count only takes a shorthand for the flag name.
+func CountP(name, shorthand string, usage string) *int {
+	return CommandLine.CountP(name, shorthand, usage)
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/duration.go b/Godeps/_workspace/src/github.com/spf13/pflag/duration.go
index 66ed7ac93c..e9debef88e 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/duration.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/duration.go
@@ -1,6 +1,8 @@
 package pflag
 
-import "time"
+import (
+	"time"
+)
 
 // -- time.Duration Value
 type durationValue time.Duration
@@ -22,13 +24,26 @@ func (d *durationValue) Type() string {
 
 func (d *durationValue) String() string { return (*time.Duration)(d).String() }
 
+func durationConv(sval string) (interface{}, error) {
+	return time.ParseDuration(sval)
+}
+
+// GetDuration return the duration value of a flag with the given name
+func (f *FlagSet) GetDuration(name string) (time.Duration, error) {
+	val, err := f.getFlagType(name, "duration", durationConv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(time.Duration), nil
+}
+
 // DurationVar defines a time.Duration flag with specified name, default value, and usage string.
 // The argument p points to a time.Duration variable in which to store the value of the flag.
 func (f *FlagSet) DurationVar(p *time.Duration, name string, value time.Duration, usage string) {
 	f.VarP(newDurationValue(value, p), name, "", usage)
 }
 
-// Like DurationVar, but accepts a shorthand letter that can be used after a single dash.
+// DurationVarP is like DurationVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) DurationVarP(p *time.Duration, name, shorthand string, value time.Duration, usage string) {
 	f.VarP(newDurationValue(value, p), name, shorthand, usage)
 }
@@ -39,7 +54,7 @@ func DurationVar(p *time.Duration, name string, value time.Duration, usage strin
 	CommandLine.VarP(newDurationValue(value, p), name, "", usage)
 }
 
-// Like DurationVar, but accepts a shorthand letter that can be used after a single dash.
+// DurationVarP is like DurationVar, but accepts a shorthand letter that can be used after a single dash.
 func DurationVarP(p *time.Duration, name, shorthand string, value time.Duration, usage string) {
 	CommandLine.VarP(newDurationValue(value, p), name, shorthand, usage)
 }
@@ -52,7 +67,7 @@ func (f *FlagSet) Duration(name string, value time.Duration, usage string) *time
 	return p
 }
 
-// Like Duration, but accepts a shorthand letter that can be used after a single dash.
+// DurationP is like Duration, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) DurationP(name, shorthand string, value time.Duration, usage string) *time.Duration {
 	p := new(time.Duration)
 	f.DurationVarP(p, name, shorthand, value, usage)
@@ -65,7 +80,7 @@ func Duration(name string, value time.Duration, usage string) *time.Duration {
 	return CommandLine.DurationP(name, "", value, usage)
 }
 
-// Like Duration, but accepts a shorthand letter that can be used after a single dash.
+// DurationP is like Duration, but accepts a shorthand letter that can be used after a single dash.
 func DurationP(name, shorthand string, value time.Duration, usage string) *time.Duration {
 	return CommandLine.DurationP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/example_test.go b/Godeps/_workspace/src/github.com/spf13/pflag/example_test.go
deleted file mode 100644
index 9be7a49f26..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/pflag/example_test.go
+++ /dev/null
@@ -1,77 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// These examples demonstrate more intricate uses of the flag package.
-package pflag_test
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	flag "github.com/spf13/pflag"
-)
-
-// Example 1: A single string flag called "species" with default value "gopher".
-var species = flag.String("species", "gopher", "the species we are studying")
-
-// Example 2: A flag with a shorthand letter.
-var gopherType = flag.StringP("gopher_type", "g", "pocket", "the variety of gopher")
-
-// Example 3: A user-defined flag type, a slice of durations.
-type interval []time.Duration
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (i *interval) String() string {
-	return fmt.Sprint(*i)
-}
-
-func (i *interval) Type() string {
-	return "interval"
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (i *interval) Set(value string) error {
-	// If we wanted to allow the flag to be set multiple times,
-	// accumulating values, we would delete this if statement.
-	// That would permit usages such as
-	//	-deltaT 10s -deltaT 15s
-	// and other combinations.
-	if len(*i) > 0 {
-		return errors.New("interval flag already set")
-	}
-	for _, dt := range strings.Split(value, ",") {
-		duration, err := time.ParseDuration(dt)
-		if err != nil {
-			return err
-		}
-		*i = append(*i, duration)
-	}
-	return nil
-}
-
-// Define a flag to accumulate durations. Because it has a special type,
-// we need to use the Var function and therefore create the flag during
-// init.
-
-var intervalFlag interval
-
-func init() {
-	// Tie the command-line flag to the intervalFlag variable and
-	// set a usage message.
-	flag.Var(&intervalFlag, "deltaT", "comma-separated list of intervals to use between events")
-}
-
-func Example() {
-	// All the interesting pieces are with the variables declared above, but
-	// to enable the flag package to see the flags defined there, one must
-	// execute, typically at the start of main (not init!):
-	//	flag.Parse()
-	// We don't run it here because this is not a main function and
-	// the testing suite has already parsed the flags.
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/export_test.go b/Godeps/_workspace/src/github.com/spf13/pflag/export_test.go
deleted file mode 100644
index 9318fee00e..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/pflag/export_test.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2010 The Go Authors.  All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pflag
-
-import (
-	"io/ioutil"
-	"os"
-)
-
-// Additional routines compiled into the package only during testing.
-
-// ResetForTesting clears all flag state and sets the usage function as directed.
-// After calling ResetForTesting, parse errors in flag handling will not
-// exit the program.
-func ResetForTesting(usage func()) {
-	CommandLine = &FlagSet{
-		name:          os.Args[0],
-		errorHandling: ContinueOnError,
-		output:        ioutil.Discard,
-	}
-	Usage = usage
-}
-
-// GetCommandLine returns the default FlagSet.
-func GetCommandLine() *FlagSet {
-	return CommandLine
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/flag.go b/Godeps/_workspace/src/github.com/spf13/pflag/flag.go
index 0070b93ee8..fd91440341 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/flag.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/flag.go
@@ -3,98 +3,98 @@
 // license that can be found in the LICENSE file.
 
 /*
-	pflag is a drop-in replacement for Go's flag package, implementing
-	POSIX/GNU-style --flags.
+Package pflag is a drop-in replacement for Go's flag package, implementing
+POSIX/GNU-style --flags.
 
-	pflag is compatible with the GNU extensions to the POSIX recommendations
-	for command-line options. See
-	http://www.gnu.org/software/libc/manual/html_node/Argument-Syntax.html
+pflag is compatible with the GNU extensions to the POSIX recommendations
+for command-line options. See
+http://www.gnu.org/software/libc/manual/html_node/Argument-Syntax.html
 
-	Usage:
+Usage:
 
-	pflag is a drop-in replacement of Go's native flag package. If you import
-	pflag under the name "flag" then all code should continue to function
-	with no changes.
+pflag is a drop-in replacement of Go's native flag package. If you import
+pflag under the name "flag" then all code should continue to function
+with no changes.
 
-		import flag "github.com/ogier/pflag"
+	import flag "github.com/ogier/pflag"
 
 	There is one exception to this: if you directly instantiate the Flag struct
-	there is one more field "Shorthand" that you will need to set.
-	Most code never instantiates this struct directly, and instead uses
-	functions such as String(), BoolVar(), and Var(), and is therefore
-	unaffected.
+there is one more field "Shorthand" that you will need to set.
+Most code never instantiates this struct directly, and instead uses
+functions such as String(), BoolVar(), and Var(), and is therefore
+unaffected.
 
-	Define flags using flag.String(), Bool(), Int(), etc.
+Define flags using flag.String(), Bool(), Int(), etc.
 
-	This declares an integer flag, -flagname, stored in the pointer ip, with type *int.
-		var ip = flag.Int("flagname", 1234, "help message for flagname")
-	If you like, you can bind the flag to a variable using the Var() functions.
-		var flagvar int
-		func init() {
-			flag.IntVar(&flagvar, "flagname", 1234, "help message for flagname")
-		}
-	Or you can create custom flags that satisfy the Value interface (with
-	pointer receivers) and couple them to flag parsing by
-		flag.Var(&flagVal, "name", "help message for flagname")
-	For such flags, the default value is just the initial value of the variable.
+This declares an integer flag, -flagname, stored in the pointer ip, with type *int.
+	var ip = flag.Int("flagname", 1234, "help message for flagname")
+If you like, you can bind the flag to a variable using the Var() functions.
+	var flagvar int
+	func init() {
+		flag.IntVar(&flagvar, "flagname", 1234, "help message for flagname")
+	}
+Or you can create custom flags that satisfy the Value interface (with
+pointer receivers) and couple them to flag parsing by
+	flag.Var(&flagVal, "name", "help message for flagname")
+For such flags, the default value is just the initial value of the variable.
 
-	After all flags are defined, call
-		flag.Parse()
-	to parse the command line into the defined flags.
+After all flags are defined, call
+	flag.Parse()
+to parse the command line into the defined flags.
 
-	Flags may then be used directly. If you're using the flags themselves,
-	they are all pointers; if you bind to variables, they're values.
-		fmt.Println("ip has value ", *ip)
-		fmt.Println("flagvar has value ", flagvar)
+Flags may then be used directly. If you're using the flags themselves,
+they are all pointers; if you bind to variables, they're values.
+	fmt.Println("ip has value ", *ip)
+	fmt.Println("flagvar has value ", flagvar)
 
-	After parsing, the arguments after the flag are available as the
-	slice flag.Args() or individually as flag.Arg(i).
-	The arguments are indexed from 0 through flag.NArg()-1.
+After parsing, the arguments after the flag are available as the
+slice flag.Args() or individually as flag.Arg(i).
+The arguments are indexed from 0 through flag.NArg()-1.
 
-	The pflag package also defines some new functions that are not in flag,
-	that give one-letter shorthands for flags. You can use these by appending
-	'P' to the name of any function that defines a flag.
-		var ip = flag.IntP("flagname", "f", 1234, "help message")
-		var flagvar bool
-		func init() {
-			flag.BoolVarP("boolname", "b", true, "help message")
-		}
-		flag.VarP(&flagVar, "varname", "v", 1234, "help message")
-	Shorthand letters can be used with single dashes on the command line.
-	Boolean shorthand flags can be combined with other shorthand flags.
+The pflag package also defines some new functions that are not in flag,
+that give one-letter shorthands for flags. You can use these by appending
+'P' to the name of any function that defines a flag.
+	var ip = flag.IntP("flagname", "f", 1234, "help message")
+	var flagvar bool
+	func init() {
+		flag.BoolVarP("boolname", "b", true, "help message")
+	}
+	flag.VarP(&flagVar, "varname", "v", 1234, "help message")
+Shorthand letters can be used with single dashes on the command line.
+Boolean shorthand flags can be combined with other shorthand flags.
 
-	Command line flag syntax:
-		--flag    // boolean flags only
-		--flag=x
+Command line flag syntax:
+	--flag    // boolean flags only
+	--flag=x
 
-	Unlike the flag package, a single dash before an option means something
-	different than a double dash. Single dashes signify a series of shorthand
-	letters for flags. All but the last shorthand letter must be boolean flags.
-		// boolean flags
-		-f
-		-abc
-		// non-boolean flags
-		-n 1234
-		-Ifile
-		// mixed
-		-abcs "hello"
-		-abcn1234
+Unlike the flag package, a single dash before an option means something
+different than a double dash. Single dashes signify a series of shorthand
+letters for flags. All but the last shorthand letter must be boolean flags.
+	// boolean flags
+	-f
+	-abc
+	// non-boolean flags
+	-n 1234
+	-Ifile
+	// mixed
+	-abcs "hello"
+	-abcn1234
 
-	Flag parsing stops after the terminator "--". Unlike the flag package,
-	flags can be interspersed with arguments anywhere on the command line
-	before this terminator.
+Flag parsing stops after the terminator "--". Unlike the flag package,
+flags can be interspersed with arguments anywhere on the command line
+before this terminator.
 
-	Integer flags accept 1234, 0664, 0x1234 and may be negative.
-	Boolean flags (in their long form) accept 1, 0, t, f, true, false,
-	TRUE, FALSE, True, False.
-	Duration flags accept any input valid for time.ParseDuration.
+Integer flags accept 1234, 0664, 0x1234 and may be negative.
+Boolean flags (in their long form) accept 1, 0, t, f, true, false,
+TRUE, FALSE, True, False.
+Duration flags accept any input valid for time.ParseDuration.
 
-	The default set of command-line flags is controlled by
-	top-level functions.  The FlagSet type allows one to define
-	independent sets of flags, such as to implement subcommands
-	in a command-line interface. The methods of FlagSet are
-	analogous to the top-level functions for the command-line
-	flag set.
+The default set of command-line flags is controlled by
+top-level functions.  The FlagSet type allows one to define
+independent sets of flags, such as to implement subcommands
+in a command-line interface. The methods of FlagSet are
+analogous to the top-level functions for the command-line
+flag set.
 */
 package pflag
 
@@ -115,8 +115,11 @@ var ErrHelp = errors.New("pflag: help requested")
 type ErrorHandling int
 
 const (
+	// ContinueOnError will return an err from Parse() if an error is found
 	ContinueOnError ErrorHandling = iota
+	// ExitOnError will call os.Exit(2) if an error is found when parsing
 	ExitOnError
+	// PanicOnError will panic() if an error is found when parsing flags
 	PanicOnError
 )
 
@@ -137,6 +140,7 @@ type FlagSet struct {
 	formal            map[NormalizedName]*Flag
 	shorthands        map[byte]*Flag
 	args              []string // arguments after flags
+	argsLenAtDash     int      // len(args) when a '--' was located when parsing, or -1 if no --
 	exitOnError       bool     // does the program exit if there's an error?
 	errorHandling     ErrorHandling
 	output            io.Writer // nil means stderr; use out() accessor
@@ -146,14 +150,17 @@ type FlagSet struct {
 
 // A Flag represents the state of a flag.
 type Flag struct {
-	Name        string              // name as it appears on command line
-	Shorthand   string              // one-letter abbreviated flag
-	Usage       string              // help message
-	Value       Value               // value as set
-	DefValue    string              // default value (as text); for usage message
-	Changed     bool                // If the user set the value (or if left to default)
-	Deprecated  string              // If this flag is deprecated, this string is the new or now thing to use
-	Annotations map[string][]string // used by cobra.Command  bash autocomple code
+	Name                string              // name as it appears on command line
+	Shorthand           string              // one-letter abbreviated flag
+	Usage               string              // help message
+	Value               Value               // value as set
+	DefValue            string              // default value (as text); for usage message
+	Changed             bool                // If the user set the value (or if left to default)
+	NoOptDefVal         string              //default value (as text); if the flag is on the command line without any options
+	Deprecated          string              // If this flag is deprecated, this string is the new or now thing to use
+	Hidden              bool                // used by cobra.Command to allow flags to be hidden from help/usage text
+	ShorthandDeprecated string              // If the shorthand of this flag is deprecated, this string is the new or now thing to use
+	Annotations         map[string][]string // used by cobra.Command bash autocomple code
 }
 
 // Value is the interface to the dynamic value stored in a flag.
@@ -180,6 +187,11 @@ func sortFlags(flags map[NormalizedName]*Flag) []*Flag {
 	return result
 }
 
+// SetNormalizeFunc allows you to add a function which can translate flag names.
+// Flags added to the FlagSet will be translated and then when anything tries to
+// look up the flag that will also be translated. So it would be possible to create
+// a flag named "getURL" and have it translated to "geturl".  A user could then pass
+// "--getUrl" which may also be translated to "geturl" and everything will work.
 func (f *FlagSet) SetNormalizeFunc(n func(f *FlagSet, name string) NormalizedName) {
 	f.normalizeNameFunc = n
 	for k, v := range f.formal {
@@ -190,6 +202,8 @@ func (f *FlagSet) SetNormalizeFunc(n func(f *FlagSet, name string) NormalizedNam
 	}
 }
 
+// GetNormalizeFunc returns the previously set NormalizeFunc of a function which
+// does no translation, if not set previously.
 func (f *FlagSet) GetNormalizeFunc() func(f *FlagSet, name string) NormalizedName {
 	if f.normalizeNameFunc != nil {
 		return f.normalizeNameFunc
@@ -223,6 +237,7 @@ func (f *FlagSet) VisitAll(fn func(*Flag)) {
 	}
 }
 
+// HasFlags returns a bool to indicate if the FlagSet has any flags definied.
 func (f *FlagSet) HasFlags() bool {
 	return len(f.formal) > 0
 }
@@ -257,16 +272,75 @@ func (f *FlagSet) lookup(name NormalizedName) *Flag {
 	return f.formal[name]
 }
 
-// Mark a flag deprecated in your program
+// func to return a given type for a given flag name
+func (f *FlagSet) getFlagType(name string, ftype string, convFunc func(sval string) (interface{}, error)) (interface{}, error) {
+	flag := f.Lookup(name)
+	if flag == nil {
+		err := fmt.Errorf("flag accessed but not defined: %s", name)
+		return nil, err
+	}
+
+	if flag.Value.Type() != ftype {
+		err := fmt.Errorf("trying to get %s value of flag of type %s", ftype, flag.Value.Type())
+		return nil, err
+	}
+
+	sval := flag.Value.String()
+	result, err := convFunc(sval)
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+// ArgsLenAtDash will return the length of f.Args at the moment when a -- was
+// found during arg parsing. This allows your program to know which args were
+// before the -- and which came after.
+func (f *FlagSet) ArgsLenAtDash() int {
+	return f.argsLenAtDash
+}
+
+// MarkDeprecated indicated that a flag is deprecated in your program. It will
+// continue to function but will not show up in help or usage messages. Using
+// this flag will also print the given usageMessage.
 func (f *FlagSet) MarkDeprecated(name string, usageMessage string) error {
 	flag := f.Lookup(name)
 	if flag == nil {
 		return fmt.Errorf("flag %q does not exist", name)
 	}
+	if len(usageMessage) == 0 {
+		return fmt.Errorf("deprecated message for flag %q must be set", name)
+	}
 	flag.Deprecated = usageMessage
 	return nil
 }
 
+// MarkShorthandDeprecated will mark the shorthand of a flag deprecated in your
+// program. It will continue to function but will not show up in help or usage
+// messages. Using this flag will also print the given usageMessage.
+func (f *FlagSet) MarkShorthandDeprecated(name string, usageMessage string) error {
+	flag := f.Lookup(name)
+	if flag == nil {
+		return fmt.Errorf("flag %q does not exist", name)
+	}
+	if len(usageMessage) == 0 {
+		return fmt.Errorf("deprecated message for flag %q must be set", name)
+	}
+	flag.ShorthandDeprecated = usageMessage
+	return nil
+}
+
+// MarkHidden sets a flag to 'hidden' in your program. It will continue to
+// function but will not show up in help or usage messages.
+func (f *FlagSet) MarkHidden(name string) error {
+	flag := f.Lookup(name)
+	if flag == nil {
+		return fmt.Errorf("flag %q does not exist", name)
+	}
+	flag.Hidden = true
+	return nil
+}
+
 // Lookup returns the Flag structure of the named command-line flag,
 // returning nil if none exists.
 func Lookup(name string) *Flag {
@@ -295,6 +369,33 @@ func (f *FlagSet) Set(name, value string) error {
 	return nil
 }
 
+// SetAnnotation allows one to set arbitrary annotations on a flag in the FlagSet.
+// This is sometimes used by spf13/cobra programs which want to generate additional
+// bash completion information.
+func (f *FlagSet) SetAnnotation(name, key string, values []string) error {
+	normalName := f.normalizeFlagName(name)
+	flag, ok := f.formal[normalName]
+	if !ok {
+		return fmt.Errorf("no such flag -%v", name)
+	}
+	if flag.Annotations == nil {
+		flag.Annotations = map[string][]string{}
+	}
+	flag.Annotations[key] = values
+	return nil
+}
+
+// Changed returns true if the flag was explicitly set during Parse() and false
+// otherwise
+func (f *FlagSet) Changed(name string) bool {
+	flag := f.Lookup(name)
+	// If a flag doesn't exist, it wasn't changed....
+	if flag == nil {
+		return false
+	}
+	return flag.Changed
+}
+
 // Set sets the value of the named command-line flag.
 func Set(name, value string) error {
 	return CommandLine.Set(name, value)
@@ -303,42 +404,43 @@ func Set(name, value string) error {
 // PrintDefaults prints, to standard error unless configured
 // otherwise, the default values of all defined flags in the set.
 func (f *FlagSet) PrintDefaults() {
-	f.VisitAll(func(flag *Flag) {
-		if len(flag.Deprecated) > 0 {
-			return
-		}
-		format := "--%s=%s: %s\n"
-		if _, ok := flag.Value.(*stringValue); ok {
-			// put quotes on the value
-			format = "--%s=%q: %s\n"
-		}
-		if len(flag.Shorthand) > 0 {
-			format = "  -%s, " + format
-		} else {
-			format = "   %s   " + format
-		}
-		fmt.Fprintf(f.out(), format, flag.Shorthand, flag.Name, flag.DefValue, flag.Usage)
-	})
+	usages := f.FlagUsages()
+	fmt.Fprintf(f.out(), "%s", usages)
 }
 
+// FlagUsages Returns a string containing the usage information for all flags in
+// the FlagSet
 func (f *FlagSet) FlagUsages() string {
 	x := new(bytes.Buffer)
 
 	f.VisitAll(func(flag *Flag) {
-		if len(flag.Deprecated) > 0 {
+		if len(flag.Deprecated) > 0 || flag.Hidden {
 			return
 		}
-		format := "--%s=%s: %s\n"
-		if _, ok := flag.Value.(*stringValue); ok {
-			// put quotes on the value
-			format = "--%s=%q: %s\n"
-		}
-		if len(flag.Shorthand) > 0 {
-			format = "  -%s, " + format
+		format := ""
+		if len(flag.Shorthand) > 0 && len(flag.ShorthandDeprecated) == 0 {
+			format = "  -%s, --%s"
 		} else {
-			format = "   %s   " + format
+			format = "   %s   --%s"
 		}
-		fmt.Fprintf(x, format, flag.Shorthand, flag.Name, flag.DefValue, flag.Usage)
+		if len(flag.NoOptDefVal) > 0 {
+			format = format + "["
+		}
+		if flag.Value.Type() == "string" {
+			// put quotes on the value
+			format = format + "=%q"
+		} else {
+			format = format + "=%s"
+		}
+		if len(flag.NoOptDefVal) > 0 {
+			format = format + "]"
+		}
+		format = format + ": %s\n"
+		shorthand := flag.Shorthand
+		if len(flag.ShorthandDeprecated) > 0 {
+			shorthand = ""
+		}
+		fmt.Fprintf(x, format, shorthand, flag.Name, flag.DefValue, flag.Usage)
 	})
 
 	return x.String()
@@ -409,8 +511,8 @@ func (f *FlagSet) Var(value Value, name string, usage string) {
 	f.VarP(value, name, "", usage)
 }
 
-// Like Var, but accepts a shorthand letter that can be used after a single dash.
-func (f *FlagSet) VarP(value Value, name, shorthand, usage string) {
+// VarPF is like VarP, but returns the flag created
+func (f *FlagSet) VarPF(value Value, name, shorthand, usage string) *Flag {
 	// Remember the default value as a string; it won't change.
 	flag := &Flag{
 		Name:      name,
@@ -420,11 +522,18 @@ func (f *FlagSet) VarP(value Value, name, shorthand, usage string) {
 		DefValue:  value.String(),
 	}
 	f.AddFlag(flag)
+	return flag
 }
 
+// VarP is like Var, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) VarP(value Value, name, shorthand, usage string) {
+	_ = f.VarPF(value, name, shorthand, usage)
+}
+
+// AddFlag will add the flag to the FlagSet
 func (f *FlagSet) AddFlag(flag *Flag) {
 	// Call normalizeFlagName function only once
-	var normalizedFlagName NormalizedName = f.normalizeFlagName(flag.Name)
+	normalizedFlagName := f.normalizeFlagName(flag.Name)
 
 	_, alreadythere := f.formal[normalizedFlagName]
 	if alreadythere {
@@ -458,6 +567,19 @@ func (f *FlagSet) AddFlag(flag *Flag) {
 	f.shorthands[c] = flag
 }
 
+// AddFlagSet adds one FlagSet to another. If a flag is already present in f
+// the flag from newSet will be ignored
+func (f *FlagSet) AddFlagSet(newSet *FlagSet) {
+	if newSet == nil {
+		return
+	}
+	newSet.VisitAll(func(flag *Flag) {
+		if f.Lookup(flag.Name) == nil {
+			f.AddFlag(flag)
+		}
+	})
+}
+
 // Var defines a flag with the specified name and usage string. The type and
 // value of the flag are represented by the first argument, of type Value, which
 // typically holds a user-defined implementation of Value. For instance, the
@@ -468,7 +590,7 @@ func Var(value Value, name string, usage string) {
 	CommandLine.VarP(value, name, "", usage)
 }
 
-// Like Var, but accepts a shorthand letter that can be used after a single dash.
+// VarP is like Var, but accepts a shorthand letter that can be used after a single dash.
 func VarP(value Value, name, shorthand, usage string) {
 	CommandLine.VarP(value, name, shorthand, usage)
 }
@@ -507,9 +629,21 @@ func (f *FlagSet) setFlag(flag *Flag, value string, origArg string) error {
 	if len(flag.Deprecated) > 0 {
 		fmt.Fprintf(os.Stderr, "Flag --%s has been deprecated, %s\n", flag.Name, flag.Deprecated)
 	}
+	if len(flag.ShorthandDeprecated) > 0 && containsShorthand(origArg, flag.Shorthand) {
+		fmt.Fprintf(os.Stderr, "Flag shorthand -%s has been deprecated, %s\n", flag.Shorthand, flag.ShorthandDeprecated)
+	}
 	return nil
 }
 
+func containsShorthand(arg, shorthand string) bool {
+	// filter out flags --<flag_name>
+	if strings.HasPrefix(arg, "-") {
+		return false
+	}
+	arg = strings.SplitN(arg, "=", 2)[0]
+	return strings.Contains(arg, shorthand)
+}
+
 func (f *FlagSet) parseLongArg(s string, args []string) (a []string, err error) {
 	a = args
 	name := s[2:]
@@ -532,11 +666,15 @@ func (f *FlagSet) parseLongArg(s string, args []string) (a []string, err error)
 	if len(split) == 2 {
 		// '--flag=arg'
 		value = split[1]
-	} else if bv, ok := flag.Value.(boolFlag); ok && bv.IsBoolFlag() {
-		// '--flag' (where flag is a bool)
-		value = "true"
+	} else if len(flag.NoOptDefVal) > 0 {
+		// '--flag' (arg was optional)
+		value = flag.NoOptDefVal
+	} else if len(a) > 0 {
+		// '--flag arg'
+		value = a[0]
+		a = a[1:]
 	} else {
-		// '--flag' (where flag was not a bool)
+		// '--flag' (arg was required)
 		err = f.failf("flag needs an argument: %s", s)
 		return
 	}
@@ -564,8 +702,8 @@ func (f *FlagSet) parseSingleShortArg(shorthands string, args []string) (outShor
 	if len(shorthands) > 2 && shorthands[1] == '=' {
 		value = shorthands[2:]
 		outShorts = ""
-	} else if bv, ok := flag.Value.(boolFlag); ok && bv.IsBoolFlag() {
-		value = "true"
+	} else if len(flag.NoOptDefVal) > 0 {
+		value = flag.NoOptDefVal
 	} else if len(shorthands) > 1 {
 		value = shorthands[1:]
 		outShorts = ""
@@ -610,6 +748,7 @@ func (f *FlagSet) parseArgs(args []string) (err error) {
 
 		if s[1] == '-' {
 			if len(s) == 2 { // "--" terminates the flags
+				f.argsLenAtDash = len(f.args)
 				f.args = append(f.args, args...)
 				break
 			}
@@ -657,7 +796,7 @@ func Parse() {
 	CommandLine.Parse(os.Args[1:])
 }
 
-// Whether to support interspersed option/non-option arguments.
+// SetInterspersed sets whether to support interspersed option/non-option arguments.
 func SetInterspersed(interspersed bool) {
 	CommandLine.SetInterspersed(interspersed)
 }
@@ -676,12 +815,13 @@ func NewFlagSet(name string, errorHandling ErrorHandling) *FlagSet {
 	f := &FlagSet{
 		name:          name,
 		errorHandling: errorHandling,
+		argsLenAtDash: -1,
 		interspersed:  true,
 	}
 	return f
 }
 
-// Whether to support interspersed option/non-option arguments.
+// SetInterspersed sets whether to support interspersed option/non-option arguments.
 func (f *FlagSet) SetInterspersed(interspersed bool) {
 	f.interspersed = interspersed
 }
@@ -692,4 +832,5 @@ func (f *FlagSet) SetInterspersed(interspersed bool) {
 func (f *FlagSet) Init(name string, errorHandling ErrorHandling) {
 	f.name = name
 	f.errorHandling = errorHandling
+	f.argsLenAtDash = -1
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/flag_test.go b/Godeps/_workspace/src/github.com/spf13/pflag/flag_test.go
deleted file mode 100644
index d3c1714b25..0000000000
--- a/Godeps/_workspace/src/github.com/spf13/pflag/flag_test.go
+++ /dev/null
@@ -1,658 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pflag
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"os"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-)
-
-var (
-	test_bool                    = Bool("test_bool", false, "bool value")
-	test_int                     = Int("test_int", 0, "int value")
-	test_int64                   = Int64("test_int64", 0, "int64 value")
-	test_uint                    = Uint("test_uint", 0, "uint value")
-	test_uint64                  = Uint64("test_uint64", 0, "uint64 value")
-	test_string                  = String("test_string", "0", "string value")
-	test_float64                 = Float64("test_float64", 0, "float64 value")
-	test_duration                = Duration("test_duration", 0, "time.Duration value")
-	normalizeFlagNameInvocations = 0
-)
-
-func boolString(s string) string {
-	if s == "0" {
-		return "false"
-	}
-	return "true"
-}
-
-func TestEverything(t *testing.T) {
-	m := make(map[string]*Flag)
-	desired := "0"
-	visitor := func(f *Flag) {
-		if len(f.Name) > 5 && f.Name[0:5] == "test_" {
-			m[f.Name] = f
-			ok := false
-			switch {
-			case f.Value.String() == desired:
-				ok = true
-			case f.Name == "test_bool" && f.Value.String() == boolString(desired):
-				ok = true
-			case f.Name == "test_duration" && f.Value.String() == desired+"s":
-				ok = true
-			}
-			if !ok {
-				t.Error("Visit: bad value", f.Value.String(), "for", f.Name)
-			}
-		}
-	}
-	VisitAll(visitor)
-	if len(m) != 8 {
-		t.Error("VisitAll misses some flags")
-		for k, v := range m {
-			t.Log(k, *v)
-		}
-	}
-	m = make(map[string]*Flag)
-	Visit(visitor)
-	if len(m) != 0 {
-		t.Errorf("Visit sees unset flags")
-		for k, v := range m {
-			t.Log(k, *v)
-		}
-	}
-	// Now set all flags
-	Set("test_bool", "true")
-	Set("test_int", "1")
-	Set("test_int64", "1")
-	Set("test_uint", "1")
-	Set("test_uint64", "1")
-	Set("test_string", "1")
-	Set("test_float64", "1")
-	Set("test_duration", "1s")
-	desired = "1"
-	Visit(visitor)
-	if len(m) != 8 {
-		t.Error("Visit fails after set")
-		for k, v := range m {
-			t.Log(k, *v)
-		}
-	}
-	// Now test they're visited in sort order.
-	var flagNames []string
-	Visit(func(f *Flag) { flagNames = append(flagNames, f.Name) })
-	if !sort.StringsAreSorted(flagNames) {
-		t.Errorf("flag names not sorted: %v", flagNames)
-	}
-}
-
-func TestUsage(t *testing.T) {
-	called := false
-	ResetForTesting(func() { called = true })
-	if GetCommandLine().Parse([]string{"--x"}) == nil {
-		t.Error("parse did not fail for unknown flag")
-	}
-	if !called {
-		t.Error("did not call Usage for unknown flag")
-	}
-}
-
-func testParse(f *FlagSet, t *testing.T) {
-	if f.Parsed() {
-		t.Error("f.Parse() = true before Parse")
-	}
-	boolFlag := f.Bool("bool", false, "bool value")
-	bool2Flag := f.Bool("bool2", false, "bool2 value")
-	bool3Flag := f.Bool("bool3", false, "bool3 value")
-	intFlag := f.Int("int", 0, "int value")
-	int8Flag := f.Int8("int8", 0, "int value")
-	int32Flag := f.Int32("int32", 0, "int value")
-	int64Flag := f.Int64("int64", 0, "int64 value")
-	uintFlag := f.Uint("uint", 0, "uint value")
-	uint8Flag := f.Uint8("uint8", 0, "uint value")
-	uint16Flag := f.Uint16("uint16", 0, "uint value")
-	uint32Flag := f.Uint32("uint32", 0, "uint value")
-	uint64Flag := f.Uint64("uint64", 0, "uint64 value")
-	stringFlag := f.String("string", "0", "string value")
-	float32Flag := f.Float32("float32", 0, "float32 value")
-	float64Flag := f.Float64("float64", 0, "float64 value")
-	ipFlag := f.IP("ip", net.ParseIP("127.0.0.1"), "ip value")
-	maskFlag := f.IPMask("mask", ParseIPv4Mask("0.0.0.0"), "mask value")
-	durationFlag := f.Duration("duration", 5*time.Second, "time.Duration value")
-	extra := "one-extra-argument"
-	args := []string{
-		"--bool",
-		"--bool2=true",
-		"--bool3=false",
-		"--int=22",
-		"--int8=-8",
-		"--int32=-32",
-		"--int64=0x23",
-		"--uint=24",
-		"--uint8=8",
-		"--uint16=16",
-		"--uint32=32",
-		"--uint64=25",
-		"--string=hello",
-		"--float32=-172e12",
-		"--float64=2718e28",
-		"--ip=10.11.12.13",
-		"--mask=255.255.255.0",
-		"--duration=2m",
-		extra,
-	}
-	if err := f.Parse(args); err != nil {
-		t.Fatal(err)
-	}
-	if !f.Parsed() {
-		t.Error("f.Parse() = false after Parse")
-	}
-	if *boolFlag != true {
-		t.Error("bool flag should be true, is ", *boolFlag)
-	}
-	if *bool2Flag != true {
-		t.Error("bool2 flag should be true, is ", *bool2Flag)
-	}
-	if *bool3Flag != false {
-		t.Error("bool3 flag should be false, is ", *bool2Flag)
-	}
-	if *intFlag != 22 {
-		t.Error("int flag should be 22, is ", *intFlag)
-	}
-	if *int8Flag != -8 {
-		t.Error("int8 flag should be 0x23, is ", *int8Flag)
-	}
-	if *int32Flag != -32 {
-		t.Error("int32 flag should be 0x23, is ", *int32Flag)
-	}
-	if *int64Flag != 0x23 {
-		t.Error("int64 flag should be 0x23, is ", *int64Flag)
-	}
-	if *uintFlag != 24 {
-		t.Error("uint flag should be 24, is ", *uintFlag)
-	}
-	if *uint8Flag != 8 {
-		t.Error("uint8 flag should be 8, is ", *uint8Flag)
-	}
-	if *uint16Flag != 16 {
-		t.Error("uint16 flag should be 16, is ", *uint16Flag)
-	}
-	if *uint32Flag != 32 {
-		t.Error("uint32 flag should be 32, is ", *uint32Flag)
-	}
-	if *uint64Flag != 25 {
-		t.Error("uint64 flag should be 25, is ", *uint64Flag)
-	}
-	if *stringFlag != "hello" {
-		t.Error("string flag should be `hello`, is ", *stringFlag)
-	}
-	if *float32Flag != -172e12 {
-		t.Error("float64 flag should be -172e12, is ", *float64Flag)
-	}
-	if *float64Flag != 2718e28 {
-		t.Error("float64 flag should be 2718e28, is ", *float64Flag)
-	}
-	if (*maskFlag).String() != ParseIPv4Mask("255.255.255.0").String() {
-		t.Error("mask flag should be 255.255.255.0, is ", (*maskFlag).String())
-	}
-	if !(*ipFlag).Equal(net.ParseIP("10.11.12.13")) {
-		t.Error("ip flag should be 10.11.12.13, is ", *ipFlag)
-	}
-	if *durationFlag != 2*time.Minute {
-		t.Error("duration flag should be 2m, is ", *durationFlag)
-	}
-	if len(f.Args()) != 1 {
-		t.Error("expected one argument, got", len(f.Args()))
-	} else if f.Args()[0] != extra {
-		t.Errorf("expected argument %q got %q", extra, f.Args()[0])
-	}
-}
-
-func TestShorthand(t *testing.T) {
-	f := NewFlagSet("shorthand", ContinueOnError)
-	if f.Parsed() {
-		t.Error("f.Parse() = true before Parse")
-	}
-	boolaFlag := f.BoolP("boola", "a", false, "bool value")
-	boolbFlag := f.BoolP("boolb", "b", false, "bool2 value")
-	boolcFlag := f.BoolP("boolc", "c", false, "bool3 value")
-	booldFlag := f.BoolP("boold", "d", false, "bool4 value")
-	stringaFlag := f.StringP("stringa", "s", "0", "string value")
-	stringzFlag := f.StringP("stringz", "z", "0", "string value")
-	extra := "interspersed-argument"
-	notaflag := "--i-look-like-a-flag"
-	args := []string{
-		"-ab",
-		extra,
-		"-cs",
-		"hello",
-		"-z=something",
-		"-d=true",
-		"--",
-		notaflag,
-	}
-	f.SetOutput(ioutil.Discard)
-	if err := f.Parse(args); err != nil {
-		t.Error("expected no error, got ", err)
-	}
-	if !f.Parsed() {
-		t.Error("f.Parse() = false after Parse")
-	}
-	if *boolaFlag != true {
-		t.Error("boola flag should be true, is ", *boolaFlag)
-	}
-	if *boolbFlag != true {
-		t.Error("boolb flag should be true, is ", *boolbFlag)
-	}
-	if *boolcFlag != true {
-		t.Error("boolc flag should be true, is ", *boolcFlag)
-	}
-	if *booldFlag != true {
-		t.Error("boold flag should be true, is ", *booldFlag)
-	}
-	if *stringaFlag != "hello" {
-		t.Error("stringa flag should be `hello`, is ", *stringaFlag)
-	}
-	if *stringzFlag != "something" {
-		t.Error("stringz flag should be `something`, is ", *stringzFlag)
-	}
-	if len(f.Args()) != 2 {
-		t.Error("expected one argument, got", len(f.Args()))
-	} else if f.Args()[0] != extra {
-		t.Errorf("expected argument %q got %q", extra, f.Args()[0])
-	} else if f.Args()[1] != notaflag {
-		t.Errorf("expected argument %q got %q", notaflag, f.Args()[1])
-	}
-}
-
-func TestParse(t *testing.T) {
-	ResetForTesting(func() { t.Error("bad parse") })
-	testParse(GetCommandLine(), t)
-}
-
-func TestFlagSetParse(t *testing.T) {
-	testParse(NewFlagSet("test", ContinueOnError), t)
-}
-
-func replaceSeparators(name string, from []string, to string) string {
-	result := name
-	for _, sep := range from {
-		result = strings.Replace(result, sep, to, -1)
-	}
-	// Type convert to indicate normalization has been done.
-	return result
-}
-
-func wordSepNormalizeFunc(f *FlagSet, name string) NormalizedName {
-	seps := []string{"-", "_"}
-	name = replaceSeparators(name, seps, ".")
-	normalizeFlagNameInvocations++
-
-	return NormalizedName(name)
-}
-
-func testWordSepNormalizedNames(args []string, t *testing.T) {
-	f := NewFlagSet("normalized", ContinueOnError)
-	if f.Parsed() {
-		t.Error("f.Parse() = true before Parse")
-	}
-	withDashFlag := f.Bool("with-dash-flag", false, "bool value")
-	// Set this after some flags have been added and before others.
-	f.SetNormalizeFunc(wordSepNormalizeFunc)
-	withUnderFlag := f.Bool("with_under_flag", false, "bool value")
-	withBothFlag := f.Bool("with-both_flag", false, "bool value")
-	if err := f.Parse(args); err != nil {
-		t.Fatal(err)
-	}
-	if !f.Parsed() {
-		t.Error("f.Parse() = false after Parse")
-	}
-	if *withDashFlag != true {
-		t.Error("withDashFlag flag should be true, is ", *withDashFlag)
-	}
-	if *withUnderFlag != true {
-		t.Error("withUnderFlag flag should be true, is ", *withUnderFlag)
-	}
-	if *withBothFlag != true {
-		t.Error("withBothFlag flag should be true, is ", *withBothFlag)
-	}
-}
-
-func TestWordSepNormalizedNames(t *testing.T) {
-	args := []string{
-		"--with-dash-flag",
-		"--with-under-flag",
-		"--with-both-flag",
-	}
-	testWordSepNormalizedNames(args, t)
-
-	args = []string{
-		"--with_dash_flag",
-		"--with_under_flag",
-		"--with_both_flag",
-	}
-	testWordSepNormalizedNames(args, t)
-
-	args = []string{
-		"--with-dash_flag",
-		"--with-under_flag",
-		"--with-both_flag",
-	}
-	testWordSepNormalizedNames(args, t)
-}
-
-func aliasAndWordSepFlagNames(f *FlagSet, name string) NormalizedName {
-	seps := []string{"-", "_"}
-
-	oldName := replaceSeparators("old-valid_flag", seps, ".")
-	newName := replaceSeparators("valid-flag", seps, ".")
-
-	name = replaceSeparators(name, seps, ".")
-	switch name {
-	case oldName:
-		name = newName
-		break
-	}
-
-	return NormalizedName(name)
-}
-
-func TestCustomNormalizedNames(t *testing.T) {
-	f := NewFlagSet("normalized", ContinueOnError)
-	if f.Parsed() {
-		t.Error("f.Parse() = true before Parse")
-	}
-
-	validFlag := f.Bool("valid-flag", false, "bool value")
-	f.SetNormalizeFunc(aliasAndWordSepFlagNames)
-	someOtherFlag := f.Bool("some-other-flag", false, "bool value")
-
-	args := []string{"--old_valid_flag", "--some-other_flag"}
-	if err := f.Parse(args); err != nil {
-		t.Fatal(err)
-	}
-
-	if *validFlag != true {
-		t.Errorf("validFlag is %v even though we set the alias --old_valid_falg", *validFlag)
-	}
-	if *someOtherFlag != true {
-		t.Error("someOtherFlag should be true, is ", *someOtherFlag)
-	}
-}
-
-// Every flag we add, the name (displayed also in usage) should normalized
-func TestNormalizationFuncShouldChangeFlagName(t *testing.T) {
-	// Test normalization after addition
-	f := NewFlagSet("normalized", ContinueOnError)
-
-	f.Bool("valid_flag", false, "bool value")
-	if f.Lookup("valid_flag").Name != "valid_flag" {
-		t.Error("The new flag should have the name 'valid_flag' instead of ", f.Lookup("valid_flag").Name)
-	}
-
-	f.SetNormalizeFunc(wordSepNormalizeFunc)
-	if f.Lookup("valid_flag").Name != "valid.flag" {
-		t.Error("The new flag should have the name 'valid.flag' instead of ", f.Lookup("valid_flag").Name)
-	}
-
-	// Test normalization before addition
-	f = NewFlagSet("normalized", ContinueOnError)
-	f.SetNormalizeFunc(wordSepNormalizeFunc)
-
-	f.Bool("valid_flag", false, "bool value")
-	if f.Lookup("valid_flag").Name != "valid.flag" {
-		t.Error("The new flag should have the name 'valid.flag' instead of ", f.Lookup("valid_flag").Name)
-	}
-}
-
-// Declare a user-defined flag type.
-type flagVar []string
-
-func (f *flagVar) String() string {
-	return fmt.Sprint([]string(*f))
-}
-
-func (f *flagVar) Set(value string) error {
-	*f = append(*f, value)
-	return nil
-}
-
-func (f *flagVar) Type() string {
-	return "flagVar"
-}
-
-func TestUserDefined(t *testing.T) {
-	var flags FlagSet
-	flags.Init("test", ContinueOnError)
-	var v flagVar
-	flags.VarP(&v, "v", "v", "usage")
-	if err := flags.Parse([]string{"--v=1", "-v2", "-v", "3"}); err != nil {
-		t.Error(err)
-	}
-	if len(v) != 3 {
-		t.Fatal("expected 3 args; got ", len(v))
-	}
-	expect := "[1 2 3]"
-	if v.String() != expect {
-		t.Errorf("expected value %q got %q", expect, v.String())
-	}
-}
-
-func TestSetOutput(t *testing.T) {
-	var flags FlagSet
-	var buf bytes.Buffer
-	flags.SetOutput(&buf)
-	flags.Init("test", ContinueOnError)
-	flags.Parse([]string{"--unknown"})
-	if out := buf.String(); !strings.Contains(out, "--unknown") {
-		t.Logf("expected output mentioning unknown; got %q", out)
-	}
-}
-
-// This tests that one can reset the flags. This still works but not well, and is
-// superseded by FlagSet.
-func TestChangingArgs(t *testing.T) {
-	ResetForTesting(func() { t.Fatal("bad parse") })
-	oldArgs := os.Args
-	defer func() { os.Args = oldArgs }()
-	os.Args = []string{"cmd", "--before", "subcmd"}
-	before := Bool("before", false, "")
-	if err := GetCommandLine().Parse(os.Args[1:]); err != nil {
-		t.Fatal(err)
-	}
-	cmd := Arg(0)
-	os.Args = []string{"subcmd", "--after", "args"}
-	after := Bool("after", false, "")
-	Parse()
-	args := Args()
-
-	if !*before || cmd != "subcmd" || !*after || len(args) != 1 || args[0] != "args" {
-		t.Fatalf("expected true subcmd true [args] got %v %v %v %v", *before, cmd, *after, args)
-	}
-}
-
-// Test that -help invokes the usage message and returns ErrHelp.
-func TestHelp(t *testing.T) {
-	var helpCalled = false
-	fs := NewFlagSet("help test", ContinueOnError)
-	fs.Usage = func() { helpCalled = true }
-	var flag bool
-	fs.BoolVar(&flag, "flag", false, "regular flag")
-	// Regular flag invocation should work
-	err := fs.Parse([]string{"--flag=true"})
-	if err != nil {
-		t.Fatal("expected no error; got ", err)
-	}
-	if !flag {
-		t.Error("flag was not set by --flag")
-	}
-	if helpCalled {
-		t.Error("help called for regular flag")
-		helpCalled = false // reset for next test
-	}
-	// Help flag should work as expected.
-	err = fs.Parse([]string{"--help"})
-	if err == nil {
-		t.Fatal("error expected")
-	}
-	if err != ErrHelp {
-		t.Fatal("expected ErrHelp; got ", err)
-	}
-	if !helpCalled {
-		t.Fatal("help was not called")
-	}
-	// If we define a help flag, that should override.
-	var help bool
-	fs.BoolVar(&help, "help", false, "help flag")
-	helpCalled = false
-	err = fs.Parse([]string{"--help"})
-	if err != nil {
-		t.Fatal("expected no error for defined --help; got ", err)
-	}
-	if helpCalled {
-		t.Fatal("help was called; should not have been for defined help flag")
-	}
-}
-
-func TestNoInterspersed(t *testing.T) {
-	f := NewFlagSet("test", ContinueOnError)
-	f.SetInterspersed(false)
-	f.Bool("true", true, "always true")
-	f.Bool("false", false, "always false")
-	err := f.Parse([]string{"--true", "break", "--false"})
-	if err != nil {
-		t.Fatal("expected no error; got ", err)
-	}
-	args := f.Args()
-	if len(args) != 2 || args[0] != "break" || args[1] != "--false" {
-		t.Fatal("expected interspersed options/non-options to fail")
-	}
-}
-
-func TestTermination(t *testing.T) {
-	f := NewFlagSet("termination", ContinueOnError)
-	boolFlag := f.BoolP("bool", "l", false, "bool value")
-	if f.Parsed() {
-		t.Error("f.Parse() = true before Parse")
-	}
-	arg1 := "ls"
-	arg2 := "-l"
-	args := []string{
-		"--",
-		arg1,
-		arg2,
-	}
-	f.SetOutput(ioutil.Discard)
-	if err := f.Parse(args); err != nil {
-		t.Fatal("expected no error; got ", err)
-	}
-	if !f.Parsed() {
-		t.Error("f.Parse() = false after Parse")
-	}
-	if *boolFlag {
-		t.Error("expected boolFlag=false, got true")
-	}
-	if len(f.Args()) != 2 {
-		t.Errorf("expected 2 arguments, got %d: %v", len(f.Args()), f.Args())
-	}
-	if f.Args()[0] != arg1 {
-		t.Errorf("expected argument %q got %q", arg1, f.Args()[0])
-	}
-	if f.Args()[1] != arg2 {
-		t.Errorf("expected argument %q got %q", arg2, f.Args()[1])
-	}
-}
-
-func TestDeprecatedFlagInDocs(t *testing.T) {
-	f := NewFlagSet("bob", ContinueOnError)
-	f.Bool("badflag", true, "always true")
-	f.MarkDeprecated("badflag", "use --good-flag instead")
-
-	out := new(bytes.Buffer)
-	f.SetOutput(out)
-	f.PrintDefaults()
-
-	if strings.Contains(out.String(), "badflag") {
-		t.Errorf("found deprecated flag in usage!")
-	}
-}
-
-func parseReturnStderr(t *testing.T, f *FlagSet, args []string) (string, error) {
-	oldStderr := os.Stderr
-	r, w, _ := os.Pipe()
-	os.Stderr = w
-
-	err := f.Parse(args)
-
-	outC := make(chan string)
-	// copy the output in a separate goroutine so printing can't block indefinitely
-	go func() {
-		var buf bytes.Buffer
-		io.Copy(&buf, r)
-		outC <- buf.String()
-	}()
-
-	w.Close()
-	os.Stderr = oldStderr
-	out := <-outC
-
-	return out, err
-}
-
-func TestDeprecatedFlagUsage(t *testing.T) {
-	f := NewFlagSet("bob", ContinueOnError)
-	f.Bool("badflag", true, "always true")
-	usageMsg := "use --good-flag instead"
-	f.MarkDeprecated("badflag", usageMsg)
-
-	args := []string{"--badflag"}
-	out, err := parseReturnStderr(t, f, args)
-	if err != nil {
-		t.Fatal("expected no error; got ", err)
-	}
-
-	if !strings.Contains(out, usageMsg) {
-		t.Errorf("usageMsg not printed when using a deprecated flag!")
-	}
-}
-
-func TestDeprecatedFlagUsageNormalized(t *testing.T) {
-	f := NewFlagSet("bob", ContinueOnError)
-	f.Bool("bad-double_flag", true, "always true")
-	f.SetNormalizeFunc(wordSepNormalizeFunc)
-	usageMsg := "use --good-flag instead"
-	f.MarkDeprecated("bad_double-flag", usageMsg)
-
-	args := []string{"--bad_double_flag"}
-	out, err := parseReturnStderr(t, f, args)
-	if err != nil {
-		t.Fatal("expected no error; got ", err)
-	}
-
-	if !strings.Contains(out, usageMsg) {
-		t.Errorf("usageMsg not printed when using a deprecated flag!")
-	}
-}
-
-// Name normalization function should be called only once on flag addition
-func TestMultipleNormalizeFlagNameInvocations(t *testing.T) {
-	normalizeFlagNameInvocations = 0
-
-	f := NewFlagSet("normalized", ContinueOnError)
-	f.SetNormalizeFunc(wordSepNormalizeFunc)
-	f.Bool("with_under_flag", false, "bool value")
-
-	if normalizeFlagNameInvocations != 1 {
-		t.Fatal("Expected normalizeFlagNameInvocations to be 1; got ", normalizeFlagNameInvocations)
-	}
-}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/float32.go b/Godeps/_workspace/src/github.com/spf13/pflag/float32.go
index b7ad67d9a2..7683fae1b1 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/float32.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/float32.go
@@ -25,13 +25,30 @@ func (f *float32Value) Type() string {
 
 func (f *float32Value) String() string { return fmt.Sprintf("%v", *f) }
 
+func float32Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseFloat(sval, 32)
+	if err != nil {
+		return 0, err
+	}
+	return float32(v), nil
+}
+
+// GetFloat32 return the float32 value of a flag with the given name
+func (f *FlagSet) GetFloat32(name string) (float32, error) {
+	val, err := f.getFlagType(name, "float32", float32Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(float32), nil
+}
+
 // Float32Var defines a float32 flag with specified name, default value, and usage string.
 // The argument p points to a float32 variable in which to store the value of the flag.
 func (f *FlagSet) Float32Var(p *float32, name string, value float32, usage string) {
 	f.VarP(newFloat32Value(value, p), name, "", usage)
 }
 
-// Like Float32Var, but accepts a shorthand letter that can be used after a single dash.
+// Float32VarP is like Float32Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Float32VarP(p *float32, name, shorthand string, value float32, usage string) {
 	f.VarP(newFloat32Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func Float32Var(p *float32, name string, value float32, usage string) {
 	CommandLine.VarP(newFloat32Value(value, p), name, "", usage)
 }
 
-// Like Float32Var, but accepts a shorthand letter that can be used after a single dash.
+// Float32VarP is like Float32Var, but accepts a shorthand letter that can be used after a single dash.
 func Float32VarP(p *float32, name, shorthand string, value float32, usage string) {
 	CommandLine.VarP(newFloat32Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Float32(name string, value float32, usage string) *float32 {
 	return p
 }
 
-// Like Float32, but accepts a shorthand letter that can be used after a single dash.
+// Float32P is like Float32, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Float32P(name, shorthand string, value float32, usage string) *float32 {
 	p := new(float32)
 	f.Float32VarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Float32(name string, value float32, usage string) *float32 {
 	return CommandLine.Float32P(name, "", value, usage)
 }
 
-// Like Float32, but accepts a shorthand letter that can be used after a single dash.
+// Float32P is like Float32, but accepts a shorthand letter that can be used after a single dash.
 func Float32P(name, shorthand string, value float32, usage string) *float32 {
 	return CommandLine.Float32P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/float64.go b/Godeps/_workspace/src/github.com/spf13/pflag/float64.go
index 0315512334..50fbf8cc1a 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/float64.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/float64.go
@@ -25,13 +25,26 @@ func (f *float64Value) Type() string {
 
 func (f *float64Value) String() string { return fmt.Sprintf("%v", *f) }
 
+func float64Conv(sval string) (interface{}, error) {
+	return strconv.ParseFloat(sval, 64)
+}
+
+// GetFloat64 return the float64 value of a flag with the given name
+func (f *FlagSet) GetFloat64(name string) (float64, error) {
+	val, err := f.getFlagType(name, "float64", float64Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(float64), nil
+}
+
 // Float64Var defines a float64 flag with specified name, default value, and usage string.
 // The argument p points to a float64 variable in which to store the value of the flag.
 func (f *FlagSet) Float64Var(p *float64, name string, value float64, usage string) {
 	f.VarP(newFloat64Value(value, p), name, "", usage)
 }
 
-// Like Float64Var, but accepts a shorthand letter that can be used after a single dash.
+// Float64VarP is like Float64Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Float64VarP(p *float64, name, shorthand string, value float64, usage string) {
 	f.VarP(newFloat64Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +55,7 @@ func Float64Var(p *float64, name string, value float64, usage string) {
 	CommandLine.VarP(newFloat64Value(value, p), name, "", usage)
 }
 
-// Like Float64Var, but accepts a shorthand letter that can be used after a single dash.
+// Float64VarP is like Float64Var, but accepts a shorthand letter that can be used after a single dash.
 func Float64VarP(p *float64, name, shorthand string, value float64, usage string) {
 	CommandLine.VarP(newFloat64Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +68,7 @@ func (f *FlagSet) Float64(name string, value float64, usage string) *float64 {
 	return p
 }
 
-// Like Float64, but accepts a shorthand letter that can be used after a single dash.
+// Float64P is like Float64, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Float64P(name, shorthand string, value float64, usage string) *float64 {
 	p := new(float64)
 	f.Float64VarP(p, name, shorthand, value, usage)
@@ -68,7 +81,7 @@ func Float64(name string, value float64, usage string) *float64 {
 	return CommandLine.Float64P(name, "", value, usage)
 }
 
-// Like Float64, but accepts a shorthand letter that can be used after a single dash.
+// Float64P is like Float64, but accepts a shorthand letter that can be used after a single dash.
 func Float64P(name, shorthand string, value float64, usage string) *float64 {
 	return CommandLine.Float64P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/golangflag.go b/Godeps/_workspace/src/github.com/spf13/pflag/golangflag.go
new file mode 100644
index 0000000000..a8c24efb64
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/golangflag.go
@@ -0,0 +1,97 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pflag
+
+import (
+	goflag "flag"
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+var _ = fmt.Print
+
+// flagValueWrapper implements pflag.Value around a flag.Value.  The main
+// difference here is the addition of the Type method that returns a string
+// name of the type.  As this is generally unknown, we approximate that with
+// reflection.
+type flagValueWrapper struct {
+	inner    goflag.Value
+	flagType string
+}
+
+// We are just copying the boolFlag interface out of goflag as that is what
+// they use to decide if a flag should get "true" when no arg is given.
+type goBoolFlag interface {
+	goflag.Value
+	IsBoolFlag() bool
+}
+
+func wrapFlagValue(v goflag.Value) Value {
+	// If the flag.Value happens to also be a pflag.Value, just use it directly.
+	if pv, ok := v.(Value); ok {
+		return pv
+	}
+
+	pv := &flagValueWrapper{
+		inner: v,
+	}
+
+	t := reflect.TypeOf(v)
+	if t.Kind() == reflect.Interface || t.Kind() == reflect.Ptr {
+		t = t.Elem()
+	}
+
+	pv.flagType = strings.TrimSuffix(t.Name(), "Value")
+	return pv
+}
+
+func (v *flagValueWrapper) String() string {
+	return v.inner.String()
+}
+
+func (v *flagValueWrapper) Set(s string) error {
+	return v.inner.Set(s)
+}
+
+func (v *flagValueWrapper) Type() string {
+	return v.flagType
+}
+
+// PFlagFromGoFlag will return a *pflag.Flag given a *flag.Flag
+func PFlagFromGoFlag(goflag *goflag.Flag) *Flag {
+	// Remember the default value as a string; it won't change.
+	flag := &Flag{
+		Name:  goflag.Name,
+		Usage: goflag.Usage,
+		Value: wrapFlagValue(goflag.Value),
+		// Looks like golang flags don't set DefValue correctly  :-(
+		//DefValue: goflag.DefValue,
+		DefValue: goflag.Value.String(),
+	}
+	if fv, ok := goflag.Value.(goBoolFlag); ok && fv.IsBoolFlag() {
+		flag.NoOptDefVal = "true"
+	}
+	return flag
+}
+
+// AddGoFlag will add the given *flag.Flag to the pflag.FlagSet
+func (f *FlagSet) AddGoFlag(goflag *goflag.Flag) {
+	if f.Lookup(goflag.Name) != nil {
+		return
+	}
+	newflag := PFlagFromGoFlag(goflag)
+	f.AddFlag(newflag)
+}
+
+// AddGoFlagSet will add the given *flag.FlagSet to the pflag.FlagSet
+func (f *FlagSet) AddGoFlagSet(newSet *goflag.FlagSet) {
+	if newSet == nil {
+		return
+	}
+	newSet.VisitAll(func(goflag *goflag.Flag) {
+		f.AddGoFlag(goflag)
+	})
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/int.go b/Godeps/_workspace/src/github.com/spf13/pflag/int.go
index dca9da6e6f..b6560368a9 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/int.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/int.go
@@ -25,13 +25,26 @@ func (i *intValue) Type() string {
 
 func (i *intValue) String() string { return fmt.Sprintf("%v", *i) }
 
+func intConv(sval string) (interface{}, error) {
+	return strconv.Atoi(sval)
+}
+
+// GetInt return the int value of a flag with the given name
+func (f *FlagSet) GetInt(name string) (int, error) {
+	val, err := f.getFlagType(name, "int", intConv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(int), nil
+}
+
 // IntVar defines an int flag with specified name, default value, and usage string.
 // The argument p points to an int variable in which to store the value of the flag.
 func (f *FlagSet) IntVar(p *int, name string, value int, usage string) {
 	f.VarP(newIntValue(value, p), name, "", usage)
 }
 
-// Like IntVar, but accepts a shorthand letter that can be used after a single dash.
+// IntVarP is like IntVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IntVarP(p *int, name, shorthand string, value int, usage string) {
 	f.VarP(newIntValue(value, p), name, shorthand, usage)
 }
@@ -42,7 +55,7 @@ func IntVar(p *int, name string, value int, usage string) {
 	CommandLine.VarP(newIntValue(value, p), name, "", usage)
 }
 
-// Like IntVar, but accepts a shorthand letter that can be used after a single dash.
+// IntVarP is like IntVar, but accepts a shorthand letter that can be used after a single dash.
 func IntVarP(p *int, name, shorthand string, value int, usage string) {
 	CommandLine.VarP(newIntValue(value, p), name, shorthand, usage)
 }
@@ -55,7 +68,7 @@ func (f *FlagSet) Int(name string, value int, usage string) *int {
 	return p
 }
 
-// Like Int, but accepts a shorthand letter that can be used after a single dash.
+// IntP is like Int, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IntP(name, shorthand string, value int, usage string) *int {
 	p := new(int)
 	f.IntVarP(p, name, shorthand, value, usage)
@@ -68,7 +81,7 @@ func Int(name string, value int, usage string) *int {
 	return CommandLine.IntP(name, "", value, usage)
 }
 
-// Like Int, but accepts a shorthand letter that can be used after a single dash.
+// IntP is like Int, but accepts a shorthand letter that can be used after a single dash.
 func IntP(name, shorthand string, value int, usage string) *int {
 	return CommandLine.IntP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/int32.go b/Godeps/_workspace/src/github.com/spf13/pflag/int32.go
index 18eaacd60d..41659a9aff 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/int32.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/int32.go
@@ -25,13 +25,30 @@ func (i *int32Value) Type() string {
 
 func (i *int32Value) String() string { return fmt.Sprintf("%v", *i) }
 
+func int32Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseInt(sval, 0, 32)
+	if err != nil {
+		return 0, err
+	}
+	return int32(v), nil
+}
+
+// GetInt32 return the int32 value of a flag with the given name
+func (f *FlagSet) GetInt32(name string) (int32, error) {
+	val, err := f.getFlagType(name, "int32", int32Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(int32), nil
+}
+
 // Int32Var defines an int32 flag with specified name, default value, and usage string.
 // The argument p points to an int32 variable in which to store the value of the flag.
 func (f *FlagSet) Int32Var(p *int32, name string, value int32, usage string) {
 	f.VarP(newInt32Value(value, p), name, "", usage)
 }
 
-// Like Int32Var, but accepts a shorthand letter that can be used after a single dash.
+// Int32VarP is like Int32Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int32VarP(p *int32, name, shorthand string, value int32, usage string) {
 	f.VarP(newInt32Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func Int32Var(p *int32, name string, value int32, usage string) {
 	CommandLine.VarP(newInt32Value(value, p), name, "", usage)
 }
 
-// Like Int32Var, but accepts a shorthand letter that can be used after a single dash.
+// Int32VarP is like Int32Var, but accepts a shorthand letter that can be used after a single dash.
 func Int32VarP(p *int32, name, shorthand string, value int32, usage string) {
 	CommandLine.VarP(newInt32Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Int32(name string, value int32, usage string) *int32 {
 	return p
 }
 
-// Like Int32, but accepts a shorthand letter that can be used after a single dash.
+// Int32P is like Int32, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int32P(name, shorthand string, value int32, usage string) *int32 {
 	p := new(int32)
 	f.Int32VarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Int32(name string, value int32, usage string) *int32 {
 	return CommandLine.Int32P(name, "", value, usage)
 }
 
-// Like Int32, but accepts a shorthand letter that can be used after a single dash.
+// Int32P is like Int32, but accepts a shorthand letter that can be used after a single dash.
 func Int32P(name, shorthand string, value int32, usage string) *int32 {
 	return CommandLine.Int32P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/int64.go b/Godeps/_workspace/src/github.com/spf13/pflag/int64.go
index 0114aaaa80..6e67e380f4 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/int64.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/int64.go
@@ -25,13 +25,26 @@ func (i *int64Value) Type() string {
 
 func (i *int64Value) String() string { return fmt.Sprintf("%v", *i) }
 
+func int64Conv(sval string) (interface{}, error) {
+	return strconv.ParseInt(sval, 0, 64)
+}
+
+// GetInt64 return the int64 value of a flag with the given name
+func (f *FlagSet) GetInt64(name string) (int64, error) {
+	val, err := f.getFlagType(name, "int64", int64Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(int64), nil
+}
+
 // Int64Var defines an int64 flag with specified name, default value, and usage string.
 // The argument p points to an int64 variable in which to store the value of the flag.
 func (f *FlagSet) Int64Var(p *int64, name string, value int64, usage string) {
 	f.VarP(newInt64Value(value, p), name, "", usage)
 }
 
-// Like Int64Var, but accepts a shorthand letter that can be used after a single dash.
+// Int64VarP is like Int64Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int64VarP(p *int64, name, shorthand string, value int64, usage string) {
 	f.VarP(newInt64Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +55,7 @@ func Int64Var(p *int64, name string, value int64, usage string) {
 	CommandLine.VarP(newInt64Value(value, p), name, "", usage)
 }
 
-// Like Int64Var, but accepts a shorthand letter that can be used after a single dash.
+// Int64VarP is like Int64Var, but accepts a shorthand letter that can be used after a single dash.
 func Int64VarP(p *int64, name, shorthand string, value int64, usage string) {
 	CommandLine.VarP(newInt64Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +68,7 @@ func (f *FlagSet) Int64(name string, value int64, usage string) *int64 {
 	return p
 }
 
-// Like Int64, but accepts a shorthand letter that can be used after a single dash.
+// Int64P is like Int64, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int64P(name, shorthand string, value int64, usage string) *int64 {
 	p := new(int64)
 	f.Int64VarP(p, name, shorthand, value, usage)
@@ -68,7 +81,7 @@ func Int64(name string, value int64, usage string) *int64 {
 	return CommandLine.Int64P(name, "", value, usage)
 }
 
-// Like Int64, but accepts a shorthand letter that can be used after a single dash.
+// Int64P is like Int64, but accepts a shorthand letter that can be used after a single dash.
 func Int64P(name, shorthand string, value int64, usage string) *int64 {
 	return CommandLine.Int64P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/int8.go b/Godeps/_workspace/src/github.com/spf13/pflag/int8.go
index aab1022f96..400db21f5e 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/int8.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/int8.go
@@ -25,13 +25,30 @@ func (i *int8Value) Type() string {
 
 func (i *int8Value) String() string { return fmt.Sprintf("%v", *i) }
 
+func int8Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseInt(sval, 0, 8)
+	if err != nil {
+		return 0, err
+	}
+	return int8(v), nil
+}
+
+// GetInt8 return the int8 value of a flag with the given name
+func (f *FlagSet) GetInt8(name string) (int8, error) {
+	val, err := f.getFlagType(name, "int8", int8Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(int8), nil
+}
+
 // Int8Var defines an int8 flag with specified name, default value, and usage string.
 // The argument p points to an int8 variable in which to store the value of the flag.
 func (f *FlagSet) Int8Var(p *int8, name string, value int8, usage string) {
 	f.VarP(newInt8Value(value, p), name, "", usage)
 }
 
-// Like Int8Var, but accepts a shorthand letter that can be used after a single dash.
+// Int8VarP is like Int8Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int8VarP(p *int8, name, shorthand string, value int8, usage string) {
 	f.VarP(newInt8Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func Int8Var(p *int8, name string, value int8, usage string) {
 	CommandLine.VarP(newInt8Value(value, p), name, "", usage)
 }
 
-// Like Int8Var, but accepts a shorthand letter that can be used after a single dash.
+// Int8VarP is like Int8Var, but accepts a shorthand letter that can be used after a single dash.
 func Int8VarP(p *int8, name, shorthand string, value int8, usage string) {
 	CommandLine.VarP(newInt8Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Int8(name string, value int8, usage string) *int8 {
 	return p
 }
 
-// Like Int8, but accepts a shorthand letter that can be used after a single dash.
+// Int8P is like Int8, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Int8P(name, shorthand string, value int8, usage string) *int8 {
 	p := new(int8)
 	f.Int8VarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Int8(name string, value int8, usage string) *int8 {
 	return CommandLine.Int8P(name, "", value, usage)
 }
 
-// Like Int8, but accepts a shorthand letter that can be used after a single dash.
+// Int8P is like Int8, but accepts a shorthand letter that can be used after a single dash.
 func Int8P(name, shorthand string, value int8, usage string) *int8 {
 	return CommandLine.Int8P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/int_slice.go b/Godeps/_workspace/src/github.com/spf13/pflag/int_slice.go
new file mode 100644
index 0000000000..1e7c9edde9
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/int_slice.go
@@ -0,0 +1,128 @@
+package pflag
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// -- intSlice Value
+type intSliceValue struct {
+	value   *[]int
+	changed bool
+}
+
+func newIntSliceValue(val []int, p *[]int) *intSliceValue {
+	isv := new(intSliceValue)
+	isv.value = p
+	*isv.value = val
+	return isv
+}
+
+func (s *intSliceValue) Set(val string) error {
+	ss := strings.Split(val, ",")
+	out := make([]int, len(ss))
+	for i, d := range ss {
+		var err error
+		out[i], err = strconv.Atoi(d)
+		if err != nil {
+			return err
+		}
+
+	}
+	if !s.changed {
+		*s.value = out
+	} else {
+		*s.value = append(*s.value, out...)
+	}
+	s.changed = true
+	return nil
+}
+
+func (s *intSliceValue) Type() string {
+	return "intSlice"
+}
+
+func (s *intSliceValue) String() string {
+	out := make([]string, len(*s.value))
+	for i, d := range *s.value {
+		out[i] = fmt.Sprintf("%d", d)
+	}
+	return "[" + strings.Join(out, ",") + "]"
+}
+
+func intSliceConv(val string) (interface{}, error) {
+	val = strings.Trim(val, "[]")
+	// Empty string would cause a slice with one (empty) entry
+	if len(val) == 0 {
+		return []int{}, nil
+	}
+	ss := strings.Split(val, ",")
+	out := make([]int, len(ss))
+	for i, d := range ss {
+		var err error
+		out[i], err = strconv.Atoi(d)
+		if err != nil {
+			return nil, err
+		}
+
+	}
+	return out, nil
+}
+
+// GetIntSlice return the []int value of a flag with the given name
+func (f *FlagSet) GetIntSlice(name string) ([]int, error) {
+	val, err := f.getFlagType(name, "intSlice", intSliceConv)
+	if err != nil {
+		return []int{}, err
+	}
+	return val.([]int), nil
+}
+
+// IntSliceVar defines a intSlice flag with specified name, default value, and usage string.
+// The argument p points to a []int variable in which to store the value of the flag.
+func (f *FlagSet) IntSliceVar(p *[]int, name string, value []int, usage string) {
+	f.VarP(newIntSliceValue(value, p), name, "", usage)
+}
+
+// IntSliceVarP is like IntSliceVar, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) IntSliceVarP(p *[]int, name, shorthand string, value []int, usage string) {
+	f.VarP(newIntSliceValue(value, p), name, shorthand, usage)
+}
+
+// IntSliceVar defines a int[] flag with specified name, default value, and usage string.
+// The argument p points to a int[] variable in which to store the value of the flag.
+func IntSliceVar(p *[]int, name string, value []int, usage string) {
+	CommandLine.VarP(newIntSliceValue(value, p), name, "", usage)
+}
+
+// IntSliceVarP is like IntSliceVar, but accepts a shorthand letter that can be used after a single dash.
+func IntSliceVarP(p *[]int, name, shorthand string, value []int, usage string) {
+	CommandLine.VarP(newIntSliceValue(value, p), name, shorthand, usage)
+}
+
+// IntSlice defines a []int flag with specified name, default value, and usage string.
+// The return value is the address of a []int variable that stores the value of the flag.
+func (f *FlagSet) IntSlice(name string, value []int, usage string) *[]int {
+	p := []int{}
+	f.IntSliceVarP(&p, name, "", value, usage)
+	return &p
+}
+
+// IntSliceP is like IntSlice, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) IntSliceP(name, shorthand string, value []int, usage string) *[]int {
+	p := []int{}
+	f.IntSliceVarP(&p, name, shorthand, value, usage)
+	return &p
+}
+
+// IntSlice defines a []int flag with specified name, default value, and usage string.
+// The return value is the address of a []int variable that stores the value of the flag.
+func IntSlice(name string, value []int, usage string) *[]int {
+	return CommandLine.IntSliceP(name, "", value, usage)
+}
+
+// IntSliceP is like IntSlice, but accepts a shorthand letter that can be used after a single dash.
+func IntSliceP(name, shorthand string, value []int, usage string) *[]int {
+	return CommandLine.IntSliceP(name, shorthand, value, usage)
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/ip.go b/Godeps/_workspace/src/github.com/spf13/pflag/ip.go
index efa75fbc39..88a17430a0 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/ip.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/ip.go
@@ -3,8 +3,11 @@ package pflag
 import (
 	"fmt"
 	"net"
+	"strings"
 )
 
+var _ = strings.TrimSpace
+
 // -- net.IP value
 type ipValue net.IP
 
@@ -15,7 +18,7 @@ func newIPValue(val net.IP, p *net.IP) *ipValue {
 
 func (i *ipValue) String() string { return net.IP(*i).String() }
 func (i *ipValue) Set(s string) error {
-	ip := net.ParseIP(s)
+	ip := net.ParseIP(strings.TrimSpace(s))
 	if ip == nil {
 		return fmt.Errorf("failed to parse IP: %q", s)
 	}
@@ -27,13 +30,30 @@ func (i *ipValue) Type() string {
 	return "ip"
 }
 
+func ipConv(sval string) (interface{}, error) {
+	ip := net.ParseIP(sval)
+	if ip != nil {
+		return ip, nil
+	}
+	return nil, fmt.Errorf("invalid string being converted to IP address: %s", sval)
+}
+
+// GetIP return the net.IP value of a flag with the given name
+func (f *FlagSet) GetIP(name string) (net.IP, error) {
+	val, err := f.getFlagType(name, "ip", ipConv)
+	if err != nil {
+		return nil, err
+	}
+	return val.(net.IP), nil
+}
+
 // IPVar defines an net.IP flag with specified name, default value, and usage string.
 // The argument p points to an net.IP variable in which to store the value of the flag.
 func (f *FlagSet) IPVar(p *net.IP, name string, value net.IP, usage string) {
 	f.VarP(newIPValue(value, p), name, "", usage)
 }
 
-// Like IPVar, but accepts a shorthand letter that can be used after a single dash.
+// IPVarP is like IPVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IPVarP(p *net.IP, name, shorthand string, value net.IP, usage string) {
 	f.VarP(newIPValue(value, p), name, shorthand, usage)
 }
@@ -44,7 +64,7 @@ func IPVar(p *net.IP, name string, value net.IP, usage string) {
 	CommandLine.VarP(newIPValue(value, p), name, "", usage)
 }
 
-// Like IPVar, but accepts a shorthand letter that can be used after a single dash.
+// IPVarP is like IPVar, but accepts a shorthand letter that can be used after a single dash.
 func IPVarP(p *net.IP, name, shorthand string, value net.IP, usage string) {
 	CommandLine.VarP(newIPValue(value, p), name, shorthand, usage)
 }
@@ -57,7 +77,7 @@ func (f *FlagSet) IP(name string, value net.IP, usage string) *net.IP {
 	return p
 }
 
-// Like IP, but accepts a shorthand letter that can be used after a single dash.
+// IPP is like IP, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IPP(name, shorthand string, value net.IP, usage string) *net.IP {
 	p := new(net.IP)
 	f.IPVarP(p, name, shorthand, value, usage)
@@ -70,7 +90,7 @@ func IP(name string, value net.IP, usage string) *net.IP {
 	return CommandLine.IPP(name, "", value, usage)
 }
 
-// Like IP, but accepts a shorthand letter that can be used after a single dash.
+// IPP is like IP, but accepts a shorthand letter that can be used after a single dash.
 func IPP(name, shorthand string, value net.IP, usage string) *net.IP {
 	return CommandLine.IPP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/ipmask.go b/Godeps/_workspace/src/github.com/spf13/pflag/ipmask.go
index 09b9533e78..5bd44bd21d 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/ipmask.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/ipmask.go
@@ -3,6 +3,7 @@ package pflag
 import (
 	"fmt"
 	"net"
+	"strconv"
 )
 
 // -- net.IPMask value
@@ -27,23 +28,58 @@ func (i *ipMaskValue) Type() string {
 	return "ipMask"
 }
 
-// Parse IPv4 netmask written in IP form (e.g. 255.255.255.0).
+// ParseIPv4Mask written in IP form (e.g. 255.255.255.0).
 // This function should really belong to the net package.
 func ParseIPv4Mask(s string) net.IPMask {
 	mask := net.ParseIP(s)
 	if mask == nil {
-		return nil
+		if len(s) != 8 {
+			return nil
+		}
+		// net.IPMask.String() actually outputs things like ffffff00
+		// so write a horrible parser for that as well  :-(
+		m := []int{}
+		for i := 0; i < 4; i++ {
+			b := "0x" + s[2*i:2*i+2]
+			d, err := strconv.ParseInt(b, 0, 0)
+			if err != nil {
+				return nil
+			}
+			m = append(m, int(d))
+		}
+		s := fmt.Sprintf("%d.%d.%d.%d", m[0], m[1], m[2], m[3])
+		mask = net.ParseIP(s)
+		if mask == nil {
+			return nil
+		}
 	}
 	return net.IPv4Mask(mask[12], mask[13], mask[14], mask[15])
 }
 
+func parseIPv4Mask(sval string) (interface{}, error) {
+	mask := ParseIPv4Mask(sval)
+	if mask == nil {
+		return nil, fmt.Errorf("unable to parse %s as net.IPMask", sval)
+	}
+	return mask, nil
+}
+
+// GetIPv4Mask return the net.IPv4Mask value of a flag with the given name
+func (f *FlagSet) GetIPv4Mask(name string) (net.IPMask, error) {
+	val, err := f.getFlagType(name, "ipMask", parseIPv4Mask)
+	if err != nil {
+		return nil, err
+	}
+	return val.(net.IPMask), nil
+}
+
 // IPMaskVar defines an net.IPMask flag with specified name, default value, and usage string.
 // The argument p points to an net.IPMask variable in which to store the value of the flag.
 func (f *FlagSet) IPMaskVar(p *net.IPMask, name string, value net.IPMask, usage string) {
 	f.VarP(newIPMaskValue(value, p), name, "", usage)
 }
 
-// Like IPMaskVar, but accepts a shorthand letter that can be used after a single dash.
+// IPMaskVarP is like IPMaskVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IPMaskVarP(p *net.IPMask, name, shorthand string, value net.IPMask, usage string) {
 	f.VarP(newIPMaskValue(value, p), name, shorthand, usage)
 }
@@ -54,7 +90,7 @@ func IPMaskVar(p *net.IPMask, name string, value net.IPMask, usage string) {
 	CommandLine.VarP(newIPMaskValue(value, p), name, "", usage)
 }
 
-// Like IPMaskVar, but accepts a shorthand letter that can be used after a single dash.
+// IPMaskVarP is like IPMaskVar, but accepts a shorthand letter that can be used after a single dash.
 func IPMaskVarP(p *net.IPMask, name, shorthand string, value net.IPMask, usage string) {
 	CommandLine.VarP(newIPMaskValue(value, p), name, shorthand, usage)
 }
@@ -67,7 +103,7 @@ func (f *FlagSet) IPMask(name string, value net.IPMask, usage string) *net.IPMas
 	return p
 }
 
-// Like IPMask, but accepts a shorthand letter that can be used after a single dash.
+// IPMaskP is like IPMask, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) IPMaskP(name, shorthand string, value net.IPMask, usage string) *net.IPMask {
 	p := new(net.IPMask)
 	f.IPMaskVarP(p, name, shorthand, value, usage)
@@ -80,7 +116,7 @@ func IPMask(name string, value net.IPMask, usage string) *net.IPMask {
 	return CommandLine.IPMaskP(name, "", value, usage)
 }
 
-// Like IP, but accepts a shorthand letter that can be used after a single dash.
+// IPMaskP is like IP, but accepts a shorthand letter that can be used after a single dash.
 func IPMaskP(name, shorthand string, value net.IPMask, usage string) *net.IPMask {
 	return CommandLine.IPMaskP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/ipnet.go b/Godeps/_workspace/src/github.com/spf13/pflag/ipnet.go
new file mode 100644
index 0000000000..149b764b1e
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/ipnet.go
@@ -0,0 +1,100 @@
+package pflag
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+// IPNet adapts net.IPNet for use as a flag.
+type ipNetValue net.IPNet
+
+func (ipnet ipNetValue) String() string {
+	n := net.IPNet(ipnet)
+	return n.String()
+}
+
+func (ipnet *ipNetValue) Set(value string) error {
+	_, n, err := net.ParseCIDR(strings.TrimSpace(value))
+	if err != nil {
+		return err
+	}
+	*ipnet = ipNetValue(*n)
+	return nil
+}
+
+func (*ipNetValue) Type() string {
+	return "ipNet"
+}
+
+var _ = strings.TrimSpace
+
+func newIPNetValue(val net.IPNet, p *net.IPNet) *ipNetValue {
+	*p = val
+	return (*ipNetValue)(p)
+}
+
+func ipNetConv(sval string) (interface{}, error) {
+	_, n, err := net.ParseCIDR(strings.TrimSpace(sval))
+	if err == nil {
+		return *n, nil
+	}
+	return nil, fmt.Errorf("invalid string being converted to IPNet: %s", sval)
+}
+
+// GetIPNet return the net.IPNet value of a flag with the given name
+func (f *FlagSet) GetIPNet(name string) (net.IPNet, error) {
+	val, err := f.getFlagType(name, "ipNet", ipNetConv)
+	if err != nil {
+		return net.IPNet{}, err
+	}
+	return val.(net.IPNet), nil
+}
+
+// IPNetVar defines an net.IPNet flag with specified name, default value, and usage string.
+// The argument p points to an net.IPNet variable in which to store the value of the flag.
+func (f *FlagSet) IPNetVar(p *net.IPNet, name string, value net.IPNet, usage string) {
+	f.VarP(newIPNetValue(value, p), name, "", usage)
+}
+
+// IPNetVarP is like IPNetVar, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) IPNetVarP(p *net.IPNet, name, shorthand string, value net.IPNet, usage string) {
+	f.VarP(newIPNetValue(value, p), name, shorthand, usage)
+}
+
+// IPNetVar defines an net.IPNet flag with specified name, default value, and usage string.
+// The argument p points to an net.IPNet variable in which to store the value of the flag.
+func IPNetVar(p *net.IPNet, name string, value net.IPNet, usage string) {
+	CommandLine.VarP(newIPNetValue(value, p), name, "", usage)
+}
+
+// IPNetVarP is like IPNetVar, but accepts a shorthand letter that can be used after a single dash.
+func IPNetVarP(p *net.IPNet, name, shorthand string, value net.IPNet, usage string) {
+	CommandLine.VarP(newIPNetValue(value, p), name, shorthand, usage)
+}
+
+// IPNet defines an net.IPNet flag with specified name, default value, and usage string.
+// The return value is the address of an net.IPNet variable that stores the value of the flag.
+func (f *FlagSet) IPNet(name string, value net.IPNet, usage string) *net.IPNet {
+	p := new(net.IPNet)
+	f.IPNetVarP(p, name, "", value, usage)
+	return p
+}
+
+// IPNetP is like IPNet, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) IPNetP(name, shorthand string, value net.IPNet, usage string) *net.IPNet {
+	p := new(net.IPNet)
+	f.IPNetVarP(p, name, shorthand, value, usage)
+	return p
+}
+
+// IPNet defines an net.IPNet flag with specified name, default value, and usage string.
+// The return value is the address of an net.IPNet variable that stores the value of the flag.
+func IPNet(name string, value net.IPNet, usage string) *net.IPNet {
+	return CommandLine.IPNetP(name, "", value, usage)
+}
+
+// IPNetP is like IPNet, but accepts a shorthand letter that can be used after a single dash.
+func IPNetP(name, shorthand string, value net.IPNet, usage string) *net.IPNet {
+	return CommandLine.IPNetP(name, shorthand, value, usage)
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/string.go b/Godeps/_workspace/src/github.com/spf13/pflag/string.go
index 362fbf8a87..e296136e5b 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/string.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/string.go
@@ -20,13 +20,26 @@ func (s *stringValue) Type() string {
 
 func (s *stringValue) String() string { return fmt.Sprintf("%s", *s) }
 
+func stringConv(sval string) (interface{}, error) {
+	return sval, nil
+}
+
+// GetString return the string value of a flag with the given name
+func (f *FlagSet) GetString(name string) (string, error) {
+	val, err := f.getFlagType(name, "string", stringConv)
+	if err != nil {
+		return "", err
+	}
+	return val.(string), nil
+}
+
 // StringVar defines a string flag with specified name, default value, and usage string.
 // The argument p points to a string variable in which to store the value of the flag.
 func (f *FlagSet) StringVar(p *string, name string, value string, usage string) {
 	f.VarP(newStringValue(value, p), name, "", usage)
 }
 
-// Like StringVar, but accepts a shorthand letter that can be used after a single dash.
+// StringVarP is like StringVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) StringVarP(p *string, name, shorthand string, value string, usage string) {
 	f.VarP(newStringValue(value, p), name, shorthand, usage)
 }
@@ -37,7 +50,7 @@ func StringVar(p *string, name string, value string, usage string) {
 	CommandLine.VarP(newStringValue(value, p), name, "", usage)
 }
 
-// Like StringVar, but accepts a shorthand letter that can be used after a single dash.
+// StringVarP is like StringVar, but accepts a shorthand letter that can be used after a single dash.
 func StringVarP(p *string, name, shorthand string, value string, usage string) {
 	CommandLine.VarP(newStringValue(value, p), name, shorthand, usage)
 }
@@ -50,7 +63,7 @@ func (f *FlagSet) String(name string, value string, usage string) *string {
 	return p
 }
 
-// Like String, but accepts a shorthand letter that can be used after a single dash.
+// StringP is like String, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) StringP(name, shorthand string, value string, usage string) *string {
 	p := new(string)
 	f.StringVarP(p, name, shorthand, value, usage)
@@ -63,7 +76,7 @@ func String(name string, value string, usage string) *string {
 	return CommandLine.StringP(name, "", value, usage)
 }
 
-// Like String, but accepts a shorthand letter that can be used after a single dash.
+// StringP is like String, but accepts a shorthand letter that can be used after a single dash.
 func StringP(name, shorthand string, value string, usage string) *string {
 	return CommandLine.StringP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/string_slice.go b/Godeps/_workspace/src/github.com/spf13/pflag/string_slice.go
new file mode 100644
index 0000000000..b53648b2e5
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/string_slice.go
@@ -0,0 +1,111 @@
+package pflag
+
+import (
+	"encoding/csv"
+	"fmt"
+	"strings"
+)
+
+var _ = fmt.Fprint
+
+// -- stringSlice Value
+type stringSliceValue struct {
+	value   *[]string
+	changed bool
+}
+
+func newStringSliceValue(val []string, p *[]string) *stringSliceValue {
+	ssv := new(stringSliceValue)
+	ssv.value = p
+	*ssv.value = val
+	return ssv
+}
+
+func (s *stringSliceValue) Set(val string) error {
+	stringReader := strings.NewReader(val)
+	csvReader := csv.NewReader(stringReader)
+	v, err := csvReader.Read()
+	if err != nil {
+		return err
+	}
+	if !s.changed {
+		*s.value = v
+	} else {
+		*s.value = append(*s.value, v...)
+	}
+	s.changed = true
+	return nil
+}
+
+func (s *stringSliceValue) Type() string {
+	return "stringSlice"
+}
+
+func (s *stringSliceValue) String() string { return "[" + strings.Join(*s.value, ",") + "]" }
+
+func stringSliceConv(sval string) (interface{}, error) {
+	sval = strings.Trim(sval, "[]")
+	// An empty string would cause a slice with one (empty) string
+	if len(sval) == 0 {
+		return []string{}, nil
+	}
+	v := strings.Split(sval, ",")
+	return v, nil
+}
+
+// GetStringSlice return the []string value of a flag with the given name
+func (f *FlagSet) GetStringSlice(name string) ([]string, error) {
+	val, err := f.getFlagType(name, "stringSlice", stringSliceConv)
+	if err != nil {
+		return []string{}, err
+	}
+	return val.([]string), nil
+}
+
+// StringSliceVar defines a string flag with specified name, default value, and usage string.
+// The argument p points to a []string variable in which to store the value of the flag.
+func (f *FlagSet) StringSliceVar(p *[]string, name string, value []string, usage string) {
+	f.VarP(newStringSliceValue(value, p), name, "", usage)
+}
+
+// StringSliceVarP is like StringSliceVar, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) StringSliceVarP(p *[]string, name, shorthand string, value []string, usage string) {
+	f.VarP(newStringSliceValue(value, p), name, shorthand, usage)
+}
+
+// StringSliceVar defines a string flag with specified name, default value, and usage string.
+// The argument p points to a []string variable in which to store the value of the flag.
+func StringSliceVar(p *[]string, name string, value []string, usage string) {
+	CommandLine.VarP(newStringSliceValue(value, p), name, "", usage)
+}
+
+// StringSliceVarP is like StringSliceVar, but accepts a shorthand letter that can be used after a single dash.
+func StringSliceVarP(p *[]string, name, shorthand string, value []string, usage string) {
+	CommandLine.VarP(newStringSliceValue(value, p), name, shorthand, usage)
+}
+
+// StringSlice defines a string flag with specified name, default value, and usage string.
+// The return value is the address of a []string variable that stores the value of the flag.
+func (f *FlagSet) StringSlice(name string, value []string, usage string) *[]string {
+	p := []string{}
+	f.StringSliceVarP(&p, name, "", value, usage)
+	return &p
+}
+
+// StringSliceP is like StringSlice, but accepts a shorthand letter that can be used after a single dash.
+func (f *FlagSet) StringSliceP(name, shorthand string, value []string, usage string) *[]string {
+	p := []string{}
+	f.StringSliceVarP(&p, name, shorthand, value, usage)
+	return &p
+}
+
+// StringSlice defines a string flag with specified name, default value, and usage string.
+// The return value is the address of a []string variable that stores the value of the flag.
+func StringSlice(name string, value []string, usage string) *[]string {
+	return CommandLine.StringSliceP(name, "", value, usage)
+}
+
+// StringSliceP is like StringSlice, but accepts a shorthand letter that can be used after a single dash.
+func StringSliceP(name, shorthand string, value []string, usage string) *[]string {
+	return CommandLine.StringSliceP(name, shorthand, value, usage)
+}
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/uint.go b/Godeps/_workspace/src/github.com/spf13/pflag/uint.go
index c063fe7cbb..e142b49964 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/uint.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/uint.go
@@ -25,13 +25,30 @@ func (i *uintValue) Type() string {
 
 func (i *uintValue) String() string { return fmt.Sprintf("%v", *i) }
 
+func uintConv(sval string) (interface{}, error) {
+	v, err := strconv.ParseUint(sval, 0, 0)
+	if err != nil {
+		return 0, err
+	}
+	return uint(v), nil
+}
+
+// GetUint return the uint value of a flag with the given name
+func (f *FlagSet) GetUint(name string) (uint, error) {
+	val, err := f.getFlagType(name, "uint", uintConv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(uint), nil
+}
+
 // UintVar defines a uint flag with specified name, default value, and usage string.
 // The argument p points to a uint variable in which to store the value of the flag.
 func (f *FlagSet) UintVar(p *uint, name string, value uint, usage string) {
 	f.VarP(newUintValue(value, p), name, "", usage)
 }
 
-// Like UintVar, but accepts a shorthand letter that can be used after a single dash.
+// UintVarP is like UintVar, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) UintVarP(p *uint, name, shorthand string, value uint, usage string) {
 	f.VarP(newUintValue(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func UintVar(p *uint, name string, value uint, usage string) {
 	CommandLine.VarP(newUintValue(value, p), name, "", usage)
 }
 
-// Like UintVar, but accepts a shorthand letter that can be used after a single dash.
+// UintVarP is like UintVar, but accepts a shorthand letter that can be used after a single dash.
 func UintVarP(p *uint, name, shorthand string, value uint, usage string) {
 	CommandLine.VarP(newUintValue(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Uint(name string, value uint, usage string) *uint {
 	return p
 }
 
-// Like Uint, but accepts a shorthand letter that can be used after a single dash.
+// UintP is like Uint, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) UintP(name, shorthand string, value uint, usage string) *uint {
 	p := new(uint)
 	f.UintVarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Uint(name string, value uint, usage string) *uint {
 	return CommandLine.UintP(name, "", value, usage)
 }
 
-// Like Uint, but accepts a shorthand letter that can be used after a single dash.
+// UintP is like Uint, but accepts a shorthand letter that can be used after a single dash.
 func UintP(name, shorthand string, value uint, usage string) *uint {
 	return CommandLine.UintP(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/uint16.go b/Godeps/_workspace/src/github.com/spf13/pflag/uint16.go
index ab1c1f9ee5..5c96c19dcf 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/uint16.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/uint16.go
@@ -23,13 +23,30 @@ func (i *uint16Value) Type() string {
 	return "uint16"
 }
 
+func uint16Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseUint(sval, 0, 16)
+	if err != nil {
+		return 0, err
+	}
+	return uint16(v), nil
+}
+
+// GetUint16 return the uint16 value of a flag with the given name
+func (f *FlagSet) GetUint16(name string) (uint16, error) {
+	val, err := f.getFlagType(name, "uint16", uint16Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(uint16), nil
+}
+
 // Uint16Var defines a uint flag with specified name, default value, and usage string.
 // The argument p points to a uint variable in which to store the value of the flag.
 func (f *FlagSet) Uint16Var(p *uint16, name string, value uint16, usage string) {
 	f.VarP(newUint16Value(value, p), name, "", usage)
 }
 
-// Like Uint16Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint16VarP is like Uint16Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint16VarP(p *uint16, name, shorthand string, value uint16, usage string) {
 	f.VarP(newUint16Value(value, p), name, shorthand, usage)
 }
@@ -40,7 +57,7 @@ func Uint16Var(p *uint16, name string, value uint16, usage string) {
 	CommandLine.VarP(newUint16Value(value, p), name, "", usage)
 }
 
-// Like Uint16Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint16VarP is like Uint16Var, but accepts a shorthand letter that can be used after a single dash.
 func Uint16VarP(p *uint16, name, shorthand string, value uint16, usage string) {
 	CommandLine.VarP(newUint16Value(value, p), name, shorthand, usage)
 }
@@ -53,7 +70,7 @@ func (f *FlagSet) Uint16(name string, value uint16, usage string) *uint16 {
 	return p
 }
 
-// Like Uint16, but accepts a shorthand letter that can be used after a single dash.
+// Uint16P is like Uint16, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint16P(name, shorthand string, value uint16, usage string) *uint16 {
 	p := new(uint16)
 	f.Uint16VarP(p, name, shorthand, value, usage)
@@ -66,7 +83,7 @@ func Uint16(name string, value uint16, usage string) *uint16 {
 	return CommandLine.Uint16P(name, "", value, usage)
 }
 
-// Like Uint16, but accepts a shorthand letter that can be used after a single dash.
+// Uint16P is like Uint16, but accepts a shorthand letter that can be used after a single dash.
 func Uint16P(name, shorthand string, value uint16, usage string) *uint16 {
 	return CommandLine.Uint16P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/uint32.go b/Godeps/_workspace/src/github.com/spf13/pflag/uint32.go
index db635ae885..294fcaa32d 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/uint32.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/uint32.go
@@ -23,13 +23,30 @@ func (i *uint32Value) Type() string {
 	return "uint32"
 }
 
+func uint32Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseUint(sval, 0, 32)
+	if err != nil {
+		return 0, err
+	}
+	return uint32(v), nil
+}
+
+// GetUint32 return the uint32 value of a flag with the given name
+func (f *FlagSet) GetUint32(name string) (uint32, error) {
+	val, err := f.getFlagType(name, "uint32", uint32Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(uint32), nil
+}
+
 // Uint32Var defines a uint32 flag with specified name, default value, and usage string.
 // The argument p points to a uint32 variable in which to store the value of the flag.
 func (f *FlagSet) Uint32Var(p *uint32, name string, value uint32, usage string) {
 	f.VarP(newUint32Value(value, p), name, "", usage)
 }
 
-// Like Uint32Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint32VarP is like Uint32Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint32VarP(p *uint32, name, shorthand string, value uint32, usage string) {
 	f.VarP(newUint32Value(value, p), name, shorthand, usage)
 }
@@ -40,7 +57,7 @@ func Uint32Var(p *uint32, name string, value uint32, usage string) {
 	CommandLine.VarP(newUint32Value(value, p), name, "", usage)
 }
 
-// Like Uint32Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint32VarP is like Uint32Var, but accepts a shorthand letter that can be used after a single dash.
 func Uint32VarP(p *uint32, name, shorthand string, value uint32, usage string) {
 	CommandLine.VarP(newUint32Value(value, p), name, shorthand, usage)
 }
@@ -53,7 +70,7 @@ func (f *FlagSet) Uint32(name string, value uint32, usage string) *uint32 {
 	return p
 }
 
-// Like Uint32, but accepts a shorthand letter that can be used after a single dash.
+// Uint32P is like Uint32, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint32P(name, shorthand string, value uint32, usage string) *uint32 {
 	p := new(uint32)
 	f.Uint32VarP(p, name, shorthand, value, usage)
@@ -66,7 +83,7 @@ func Uint32(name string, value uint32, usage string) *uint32 {
 	return CommandLine.Uint32P(name, "", value, usage)
 }
 
-// Like Uint32, but accepts a shorthand letter that can be used after a single dash.
+// Uint32P is like Uint32, but accepts a shorthand letter that can be used after a single dash.
 func Uint32P(name, shorthand string, value uint32, usage string) *uint32 {
 	return CommandLine.Uint32P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/uint64.go b/Godeps/_workspace/src/github.com/spf13/pflag/uint64.go
index 99c7e805d0..c68188505a 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/uint64.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/uint64.go
@@ -25,13 +25,30 @@ func (i *uint64Value) Type() string {
 
 func (i *uint64Value) String() string { return fmt.Sprintf("%v", *i) }
 
+func uint64Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseUint(sval, 0, 64)
+	if err != nil {
+		return 0, err
+	}
+	return uint64(v), nil
+}
+
+// GetUint64 return the uint64 value of a flag with the given name
+func (f *FlagSet) GetUint64(name string) (uint64, error) {
+	val, err := f.getFlagType(name, "uint64", uint64Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(uint64), nil
+}
+
 // Uint64Var defines a uint64 flag with specified name, default value, and usage string.
 // The argument p points to a uint64 variable in which to store the value of the flag.
 func (f *FlagSet) Uint64Var(p *uint64, name string, value uint64, usage string) {
 	f.VarP(newUint64Value(value, p), name, "", usage)
 }
 
-// Like Uint64Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint64VarP is like Uint64Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint64VarP(p *uint64, name, shorthand string, value uint64, usage string) {
 	f.VarP(newUint64Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func Uint64Var(p *uint64, name string, value uint64, usage string) {
 	CommandLine.VarP(newUint64Value(value, p), name, "", usage)
 }
 
-// Like Uint64Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint64VarP is like Uint64Var, but accepts a shorthand letter that can be used after a single dash.
 func Uint64VarP(p *uint64, name, shorthand string, value uint64, usage string) {
 	CommandLine.VarP(newUint64Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Uint64(name string, value uint64, usage string) *uint64 {
 	return p
 }
 
-// Like Uint64, but accepts a shorthand letter that can be used after a single dash.
+// Uint64P is like Uint64, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint64P(name, shorthand string, value uint64, usage string) *uint64 {
 	p := new(uint64)
 	f.Uint64VarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Uint64(name string, value uint64, usage string) *uint64 {
 	return CommandLine.Uint64P(name, "", value, usage)
 }
 
-// Like Uint64, but accepts a shorthand letter that can be used after a single dash.
+// Uint64P is like Uint64, but accepts a shorthand letter that can be used after a single dash.
 func Uint64P(name, shorthand string, value uint64, usage string) *uint64 {
 	return CommandLine.Uint64P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/uint8.go b/Godeps/_workspace/src/github.com/spf13/pflag/uint8.go
index 6fef508de5..26db418adf 100644
--- a/Godeps/_workspace/src/github.com/spf13/pflag/uint8.go
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/uint8.go
@@ -25,13 +25,30 @@ func (i *uint8Value) Type() string {
 
 func (i *uint8Value) String() string { return fmt.Sprintf("%v", *i) }
 
+func uint8Conv(sval string) (interface{}, error) {
+	v, err := strconv.ParseUint(sval, 0, 8)
+	if err != nil {
+		return 0, err
+	}
+	return uint8(v), nil
+}
+
+// GetUint8 return the uint8 value of a flag with the given name
+func (f *FlagSet) GetUint8(name string) (uint8, error) {
+	val, err := f.getFlagType(name, "uint8", uint8Conv)
+	if err != nil {
+		return 0, err
+	}
+	return val.(uint8), nil
+}
+
 // Uint8Var defines a uint8 flag with specified name, default value, and usage string.
 // The argument p points to a uint8 variable in which to store the value of the flag.
 func (f *FlagSet) Uint8Var(p *uint8, name string, value uint8, usage string) {
 	f.VarP(newUint8Value(value, p), name, "", usage)
 }
 
-// Like Uint8Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint8VarP is like Uint8Var, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint8VarP(p *uint8, name, shorthand string, value uint8, usage string) {
 	f.VarP(newUint8Value(value, p), name, shorthand, usage)
 }
@@ -42,7 +59,7 @@ func Uint8Var(p *uint8, name string, value uint8, usage string) {
 	CommandLine.VarP(newUint8Value(value, p), name, "", usage)
 }
 
-// Like Uint8Var, but accepts a shorthand letter that can be used after a single dash.
+// Uint8VarP is like Uint8Var, but accepts a shorthand letter that can be used after a single dash.
 func Uint8VarP(p *uint8, name, shorthand string, value uint8, usage string) {
 	CommandLine.VarP(newUint8Value(value, p), name, shorthand, usage)
 }
@@ -55,7 +72,7 @@ func (f *FlagSet) Uint8(name string, value uint8, usage string) *uint8 {
 	return p
 }
 
-// Like Uint8, but accepts a shorthand letter that can be used after a single dash.
+// Uint8P is like Uint8, but accepts a shorthand letter that can be used after a single dash.
 func (f *FlagSet) Uint8P(name, shorthand string, value uint8, usage string) *uint8 {
 	p := new(uint8)
 	f.Uint8VarP(p, name, shorthand, value, usage)
@@ -68,7 +85,7 @@ func Uint8(name string, value uint8, usage string) *uint8 {
 	return CommandLine.Uint8P(name, "", value, usage)
 }
 
-// Like Uint8, but accepts a shorthand letter that can be used after a single dash.
+// Uint8P is like Uint8, but accepts a shorthand letter that can be used after a single dash.
 func Uint8P(name, shorthand string, value uint8, usage string) *uint8 {
 	return CommandLine.Uint8P(name, shorthand, value, usage)
 }
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/verify/all.sh b/Godeps/_workspace/src/github.com/spf13/pflag/verify/all.sh
new file mode 100644
index 0000000000..739f89c0b4
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/verify/all.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(dirname "${BASH_SOURCE}")/..
+
+# Some useful colors.
+if [[ -z "${color_start-}" ]]; then
+  declare -r color_start="\033["
+  declare -r color_red="${color_start}0;31m"
+  declare -r color_yellow="${color_start}0;33m"
+  declare -r color_green="${color_start}0;32m"
+  declare -r color_norm="${color_start}0m"
+fi
+
+SILENT=true
+
+function is-excluded {
+  for e in $EXCLUDE; do
+    if [[ $1 -ef ${BASH_SOURCE} ]]; then
+      return
+    fi
+    if [[ $1 -ef "$ROOT/hack/$e" ]]; then
+      return
+    fi
+  done
+  return 1
+}
+
+while getopts ":v" opt; do
+  case $opt in
+    v)
+      SILENT=false
+      ;;
+    \?)
+      echo "Invalid flag: -$OPTARG" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if $SILENT ; then
+  echo "Running in the silent mode, run with -v if you want to see script logs."
+fi
+
+EXCLUDE="all.sh"
+
+ret=0
+for t in `ls $ROOT/verify/*.sh`
+do
+  if is-excluded $t ; then
+    echo "Skipping $t"
+    continue
+  fi
+  if $SILENT ; then
+    echo -e "Verifying $t"
+    if bash "$t" &> /dev/null; then
+      echo -e "${color_green}SUCCESS${color_norm}"
+    else
+      echo -e "${color_red}FAILED${color_norm}"
+      ret=1
+    fi
+  else
+    bash "$t" || ret=1
+  fi
+done
+exit $ret
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/verify/gofmt.sh b/Godeps/_workspace/src/github.com/spf13/pflag/verify/gofmt.sh
new file mode 100644
index 0000000000..f66acf803b
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/verify/gofmt.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+ROOT=$(dirname "${BASH_SOURCE}")/..
+
+pushd "${ROOT}" > /dev/null
+
+GOFMT=${GOFMT:-"gofmt"}
+bad_files=$(find . -name '*.go' | xargs $GOFMT -s -l)
+if [[ -n "${bad_files}" ]]; then
+  echo "!!! '$GOFMT' needs to be run on the following files: "
+  echo "${bad_files}"
+  exit 1
+fi
+
+# ex: ts=2 sw=2 et filetype=sh
diff --git a/Godeps/_workspace/src/github.com/spf13/pflag/verify/golint.sh b/Godeps/_workspace/src/github.com/spf13/pflag/verify/golint.sh
new file mode 100644
index 0000000000..685c1778e5
--- /dev/null
+++ b/Godeps/_workspace/src/github.com/spf13/pflag/verify/golint.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+ROOT=$(dirname "${BASH_SOURCE}")/..
+GOLINT=${GOLINT:-"golint"}
+
+pushd "${ROOT}" > /dev/null
+  bad_files=$($GOLINT -min_confidence=0.9 ./...)
+  if [[ -n "${bad_files}" ]]; then
+    echo "!!! '$GOLINT' problems: "
+    echo "${bad_files}"
+    exit 1
+  fi
+popd > /dev/null
+
+# ex: ts=2 sw=2 et filetype=sh

From cf50ffcd3324a7eb9d3c5b4cab56a911ffc0ba37 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 4 Nov 2015 14:32:41 -0800
Subject: [PATCH 18/85] add message when user is required to touch yubikey to
 sign. N.B. touch is required during Sign, not SignInit Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 8da450e7d6..d633878535 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -243,6 +243,7 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	// Get the SHA256 of the payload
 	digest := sha256.Sum256(payload)
 
+	fmt.Println("Please touch the attached Yubikey to perform signing.")
 	sig, err = ctx.Sign(session, digest[:])
 	if err != nil {
 		logrus.Debugf("Error while signing: %s", err)

From be4c0669c18eb526512b9f4d4931685729259b10 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 4 Nov 2015 17:39:46 -0800
Subject: [PATCH 19/85] move import/export to cryptoservice and add import to
 yubikey Signed-off-by: David Lawrence <david.lawrence@docker.com> (github:
 endophage)

---
 client/repo.go                                |   2 +-
 client/repo_pkcs11.go                         |   2 +-
 cmd/notary-signer/main.go                     |  14 -
 cmd/notary/keys.go                            |  76 +-
 cmd/notary/main.go                            |   2 +-
 cryptoservice/crypto_service.go               |  19 +-
 .../import_export.go                          | 333 +++----
 cryptoservice/import_export_test.go           | 447 +++++++++
 keystoremanager/import_export_test.go         | 447 ---------
 keystoremanager/keystoremanager_test.go       | 866 +++++++++---------
 {pkg/passphrase => passphrase}/passphrase.go  |   9 +-
 signer/api/api_test.go                        |   5 +-
 signer/api/ecdsa_hardware_crypto_service.go   |   2 +-
 signer/api/rpc_api_test.go                    |   2 +-
 signer/api/rsa_hardware_crypto_service.go     | 212 -----
 signer/keydbstore/keydbstore.go               |   2 +-
 signer/signer_trust.go                        |   5 +
 trustmanager/keyfilestore.go                  |   2 +-
 trustmanager/keyfilestore_test.go             |   2 +-
 tuf/signed/ed25519.go                         |  37 +-
 tuf/signed/interface.go                       |   5 +-
 tuf/signed/sign_test.go                       |  27 +
 22 files changed, 1170 insertions(+), 1348 deletions(-)
 rename {keystoremanager => cryptoservice}/import_export.go (74%)
 create mode 100644 cryptoservice/import_export_test.go
 delete mode 100644 keystoremanager/import_export_test.go
 rename {pkg/passphrase => passphrase}/passphrase.go (96%)
 delete mode 100644 signer/api/rsa_hardware_crypto_service.go

diff --git a/client/repo.go b/client/repo.go
index 35820d09a1..c2b0b20278 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/store"
 )
diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index 45c91cf0e2..8186e1a497 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/store"
diff --git a/cmd/notary-signer/main.go b/cmd/notary-signer/main.go
index 5b16c622fa..fdaa91e824 100644
--- a/cmd/notary-signer/main.go
+++ b/cmd/notary-signer/main.go
@@ -131,20 +131,6 @@ func main() {
 
 	cryptoServices := make(signer.CryptoServiceIndex)
 
-	pin := mainViper.GetString(pinCode)
-	pkcs11Lib := mainViper.GetString("crypto.pkcs11lib")
-	if pkcs11Lib != "" {
-		if pin == "" {
-			log.Fatalf("Using PIN is mandatory with pkcs11")
-		}
-
-		ctx, session := SetupHSMEnv(pkcs11Lib, pin)
-
-		defer cleanup(ctx, session)
-
-		cryptoServices[data.RSAKey] = api.NewRSAHardwareCryptoService(ctx, session)
-	}
-
 	configDBType := strings.ToLower(mainViper.GetString("storage.backend"))
 	dbURL := mainViper.GetString("storage.db_url")
 	if configDBType != dbType || dbURL == "" {
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 7cc2297e48..f239c6ebbc 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -9,10 +9,12 @@ import (
 	"strings"
 
 	notaryclient "github.com/docker/notary/client"
+	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 
+	"github.com/docker/notary/tuf/data"
 	"github.com/spf13/cobra"
 )
 
@@ -117,10 +119,7 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	keyID := args[0]
 
@@ -141,25 +140,8 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	// Choose the correct filestore to remove the key from
-	keyMap := keyStoreManager.KeyStore.ListKeys()
-
-	// Attempt to find the full GUN to the key in the map
-	// This is irrelevant for removing root keys, but does no harm
-	var keyWithGUN string
-	for k := range keyMap {
-		if filepath.Base(k) == keyID {
-			keyWithGUN = k
-		}
-	}
-
-	// If empty, we didn't find any matches
-	if keyWithGUN == "" {
-		fatalf("key with key ID: %s not found\n", keyID)
-	}
-
 	// Attempt to remove the key
-	err = keyStoreManager.KeyStore.RemoveKey(keyWithGUN)
+	err = cs.RemoveKey(keyID)
 	if err != nil {
 		fatalf("failed to remove key with key ID: %s, %v", keyID, err)
 	}
@@ -178,13 +160,10 @@ func keysList(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	// Get a map of all the keys/roles
-	keysMap := keyStoreManager.KeyStore.ListKeys()
+	keysMap := cs.ListAllKeys()
 
 	fmt.Println("")
 	fmt.Println("# Root keys: ")
@@ -236,17 +215,14 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
-	keyID, err := keyStoreManager.GenRootKey(algorithm)
+	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
 	if err != nil {
 		fatalf("failed to create a new root key: %v", err)
 	}
 
-	fmt.Printf("Generated new %s key with keyID: %s\n", algorithm, keyID)
+	fmt.Printf("Generated new %s key with keyID: %s\n", algorithm, pubKey.ID())
 }
 
 // keysExport exports a collection of keys to a ZIP file
@@ -265,10 +241,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -279,9 +252,9 @@ func keysExport(cmd *cobra.Command, args []string) {
 	// unlocking passphrase and reusing that.
 	exportRetriever := passphrase.PromptRetriever()
 	if keysExportGUN != "" {
-		err = keyStoreManager.ExportKeysByGUN(exportFile, keysExportGUN, exportRetriever)
+		err = cs.ExportKeysByGUN(exportFile, keysExportGUN, exportRetriever)
 	} else {
-		err = keyStoreManager.ExportAllKeys(exportFile, exportRetriever)
+		err = cs.ExportAllKeys(exportFile, exportRetriever)
 	}
 
 	exportFile.Close()
@@ -313,10 +286,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -326,9 +296,9 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 		// Must use a different passphrase retriever to avoid caching the
 		// unlocking passphrase and reusing that.
 		exportRetriever := passphrase.PromptRetriever()
-		err = keyStoreManager.ExportRootKeyReencrypt(exportFile, keyID, exportRetriever)
+		err = cs.ExportRootKeyReencrypt(exportFile, keyID, exportRetriever)
 	} else {
-		err = keyStoreManager.ExportRootKey(exportFile, keyID)
+		err = cs.ExportRootKey(exportFile, keyID)
 	}
 	exportFile.Close()
 	if err != nil {
@@ -353,10 +323,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	zipReader, err := zip.OpenReader(importFilename)
 	if err != nil {
@@ -364,7 +331,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 	}
 	defer zipReader.Close()
 
-	err = keyStoreManager.ImportKeysZip(zipReader.Reader)
+	err = cs.ImportKeysZip(zipReader.Reader)
 
 	if err != nil {
 		fatalf("error importing keys: %v", err)
@@ -387,10 +354,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
-	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
-	}
+	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
@@ -398,7 +362,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	}
 	defer importFile.Close()
 
-	err = keyStoreManager.ImportRootKey(importFile)
+	err = cs.ImportRootKey(importFile)
 
 	if err != nil {
 		fatalf("error importing root key: %v", err)
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 4311f7d9a4..668dd2377b 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/version"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/spf13/cobra"
diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 61030af0d0..8b07a77d91 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -27,7 +27,7 @@ func NewCryptoService(gun string, keyStores ...trustmanager.KeyStore) *CryptoSer
 }
 
 // Create is used to generate keys for targets, snapshots and timestamps
-func (ccs *CryptoService) Create(role, algorithm string) (data.PublicKey, error) {
+func (cs *CryptoService) Create(role, algorithm string) (data.PublicKey, error) {
 	var privKey data.PrivateKey
 	var err error
 
@@ -119,7 +119,7 @@ func (ccs *CryptoService) RemoveKey(keyID string) (err error) {
 // Sign returns the signatures for the payload with a set of keyIDs. It ignores
 // errors to sign and expects the called to validate if the number of returned
 // signatures is adequate.
-func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
+func (cs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
 	signatures := make([]data.Signature, 0, len(keyIDs))
 	for _, keyid := range keyIDs {
 		keyName := keyid
@@ -152,9 +152,9 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
 }
 
 // ListKeys returns a list of key IDs valid for the given role
-func (ccs *CryptoService) ListKeys(role string) []string {
+func (cs *CryptoService) ListKeys(role string) []string {
 	var res []string
-	for _, ks := range ccs.keyStores {
+	for _, ks := range cs.keyStores {
 		for k, r := range ks.ListKeys() {
 			if r == role {
 				res = append(res, k)
@@ -163,3 +163,14 @@ func (ccs *CryptoService) ListKeys(role string) []string {
 	}
 	return res
 }
+
+// ListKeys returns a list of key IDs valid for the given role
+func (cs *CryptoService) ListAllKeys() map[string]string {
+	res := make(map[string]string)
+	for _, ks := range cs.keyStores {
+		for k, r := range ks.ListKeys() {
+			res[k] = r // keys are content addressed so don't care about overwrites
+		}
+	}
+	return res
+}
diff --git a/keystoremanager/import_export.go b/cryptoservice/import_export.go
similarity index 74%
rename from keystoremanager/import_export.go
rename to cryptoservice/import_export.go
index 6fd4735e3e..ddc3e3b899 100644
--- a/keystoremanager/import_export.go
+++ b/cryptoservice/import_export.go
@@ -1,4 +1,4 @@
-package keystoremanager
+package cryptoservice
 
 import (
 	"archive/zip"
@@ -11,7 +11,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/keystoremanager"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 )
 
@@ -33,11 +34,22 @@ var (
 
 // ExportRootKey exports the specified root key to an io.Writer in PEM format.
 // The key's existing encryption is preserved.
-func (km *KeyStoreManager) ExportRootKey(dest io.Writer, keyID string) error {
-	pemBytes, err := km.KeyStore.ExportKey(keyID)
+func (cs *CryptoService) ExportRootKey(dest io.Writer, keyID string) error {
+	var (
+		pemBytes []byte
+		err      error
+	)
+
+	for _, ks := range cs.keyStores {
+		pemBytes, err = ks.ExportKey(keyID)
+		if err != nil {
+			continue
+		}
+	}
 	if err != nil {
 		return err
 	}
+
 	nBytes, err := dest.Write(pemBytes)
 	if err != nil {
 		return err
@@ -50,8 +62,8 @@ func (km *KeyStoreManager) ExportRootKey(dest io.Writer, keyID string) error {
 
 // ExportRootKeyReencrypt exports the specified root key to an io.Writer in
 // PEM format. The key is reencrypted with a new passphrase.
-func (km *KeyStoreManager) ExportRootKeyReencrypt(dest io.Writer, keyID string, newPassphraseRetriever passphrase.Retriever) error {
-	privateKey, alias, err := km.KeyStore.GetKey(keyID)
+func (cs *CryptoService) ExportRootKeyReencrypt(dest io.Writer, keyID string, newPassphraseRetriever passphrase.Retriever) error {
+	privateKey, role, err := cs.GetPrivateKey(keyID)
 	if err != nil {
 		return err
 	}
@@ -60,13 +72,13 @@ func (km *KeyStoreManager) ExportRootKeyReencrypt(dest io.Writer, keyID string,
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)
 
-	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
+	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
 	if err != nil {
 		return err
 	}
 
-	err = tempKeyStore.AddKey(keyID, alias, privateKey)
+	err = tempKeyStore.AddKey(keyID, role, privateKey)
 	if err != nil {
 		return err
 	}
@@ -85,25 +97,10 @@ func (km *KeyStoreManager) ExportRootKeyReencrypt(dest io.Writer, keyID string,
 	return nil
 }
 
-// checkRootKeyIsEncrypted makes sure the root key is encrypted. We have
-// internal assumptions that depend on this.
-func checkRootKeyIsEncrypted(pemBytes []byte) error {
-	block, _ := pem.Decode(pemBytes)
-	if block == nil {
-		return ErrNoValidPrivateKey
-	}
-
-	if !x509.IsEncryptedPEMBlock(block) {
-		return ErrRootKeyNotEncrypted
-	}
-
-	return nil
-}
-
 // ImportRootKey imports a root in PEM format key from an io.Reader
 // It prompts for the key's passphrase to verify the data and to determine
 // the key ID.
-func (km *KeyStoreManager) ImportRootKey(source io.Reader) error {
+func (cs *CryptoService) ImportRootKey(source io.Reader) error {
 	pemBytes, err := ioutil.ReadAll(source)
 	if err != nil {
 		return err
@@ -113,14 +110,158 @@ func (km *KeyStoreManager) ImportRootKey(source io.Reader) error {
 		return err
 	}
 
-	if err = km.KeyStore.ImportKey(pemBytes, "root"); err != nil {
-		return err
+	for _, ks := range cs.keyStores {
+		// don't redeclare err, we want the value carried out of the loop
+		if err = ks.ImportKey(pemBytes, "root"); err != nil {
+			continue
+		}
 	}
 
 	return err
 }
 
-func moveKeys(oldKeyStore, newKeyStore *trustmanager.KeyFileStore) error {
+// ExportAllKeys exports all keys to an io.Writer in zip format.
+// newPassphraseRetriever will be used to obtain passphrases to use to encrypt the existing keys.
+func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever passphrase.Retriever) error {
+	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
+	defer os.RemoveAll(tempBaseDir)
+
+	// Create temporary keystore to use as a staging area
+	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
+	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
+	if err != nil {
+		return err
+	}
+
+	for _, ks := range cs.keyStores {
+		if err := moveKeys(ks, tempKeyStore); err != nil {
+			return err
+		}
+	}
+
+	zipWriter := zip.NewWriter(dest)
+
+	if err := addKeysToArchive(zipWriter, tempKeyStore, keystoremanager.PrivDir); err != nil {
+		return err
+	}
+
+	zipWriter.Close()
+
+	return nil
+}
+
+// ImportKeysZip imports keys from a zip file provided as an zip.Reader. The
+// keys in the root_keys directory are left encrypted, but the other keys are
+// decrypted with the specified passphrase.
+func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader) error {
+	// Temporarily store the keys in maps, so we can bail early if there's
+	// an error (for example, wrong passphrase), without leaving the key
+	// store in an inconsistent state
+	newKeys := make(map[string][]byte)
+
+	// Iterate through the files in the archive. Don't add the keys
+	for _, f := range zipReader.File {
+		fNameTrimmed := strings.TrimSuffix(f.Name, filepath.Ext(f.Name))
+
+		rc, err := f.Open()
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+
+		fileBytes, err := ioutil.ReadAll(rc)
+		if err != nil {
+			return nil
+		}
+
+		// Note that using / as a separator is okay here - the zip
+		// package guarantees that the separator will be /
+		if strings.HasPrefix(fNameTrimmed, keystoremanager.PrivDir) {
+			if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
+				if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
+					return err
+				}
+			}
+			keyName := strings.TrimPrefix(fNameTrimmed, keystoremanager.PrivDir)
+			newKeys[keyName] = fileBytes
+		} else {
+			// This path inside the zip archive doesn't look like a
+			// root key, non-root key, or alias. To avoid adding a file
+			// to the filestore that we won't be able to use, skip
+			// this file in the import.
+			continue
+		}
+	}
+
+	for keyName, pemBytes := range newKeys {
+		parts := strings.Split(keyName, "_")
+		for _, ks := range cs.keyStores {
+			if err := ks.ImportKey(pemBytes, parts[1]); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// ExportKeysByGUN exports all keys associated with a specified GUN to an
+// io.Writer in zip format. passphraseRetriever is used to select new passphrases to use to
+// encrypt the keys.
+func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseRetriever passphrase.Retriever) error {
+	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
+	defer os.RemoveAll(tempBaseDir)
+
+	// Create temporary keystore to use as a staging area
+	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
+	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, passphraseRetriever)
+	if err != nil {
+		return err
+	}
+
+	for _, ks := range cs.keyStores {
+		if err := moveKeysByGUN(ks, tempKeyStore, gun); err != nil {
+			return err
+		}
+	}
+
+	zipWriter := zip.NewWriter(dest)
+
+	if len(tempKeyStore.ListKeys()) == 0 {
+		return ErrNoKeysFoundForGUN
+	}
+
+	if err := addKeysToArchive(zipWriter, tempKeyStore, keystoremanager.PrivDir); err != nil {
+		return err
+	}
+
+	zipWriter.Close()
+
+	return nil
+}
+
+func moveKeysByGUN(oldKeyStore, newKeyStore trustmanager.KeyStore, gun string) error {
+	for relKeyPath := range oldKeyStore.ListKeys() {
+		// Skip keys that aren't associated with this GUN
+		if !strings.HasPrefix(relKeyPath, filepath.FromSlash(gun)) {
+			continue
+		}
+
+		privKey, alias, err := oldKeyStore.GetKey(relKeyPath)
+		if err != nil {
+			return err
+		}
+
+		err = newKeyStore.AddKey(relKeyPath, alias, privKey)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func moveKeys(oldKeyStore, newKeyStore trustmanager.KeyStore) error {
 	for f := range oldKeyStore.ListKeys() {
 		privateKey, alias, err := oldKeyStore.GetKey(f)
 		if err != nil {
@@ -171,139 +312,17 @@ func addKeysToArchive(zipWriter *zip.Writer, newKeyStore *trustmanager.KeyFileSt
 	return nil
 }
 
-// ExportAllKeys exports all keys to an io.Writer in zip format.
-// newPassphraseRetriever will be used to obtain passphrases to use to encrypt the existing keys.
-func (km *KeyStoreManager) ExportAllKeys(dest io.Writer, newPassphraseRetriever passphrase.Retriever) error {
-	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
-	defer os.RemoveAll(tempBaseDir)
-
-	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
-	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
-	if err != nil {
-		return err
+// checkRootKeyIsEncrypted makes sure the root key is encrypted. We have
+// internal assumptions that depend on this.
+func checkRootKeyIsEncrypted(pemBytes []byte) error {
+	block, _ := pem.Decode(pemBytes)
+	if block == nil {
+		return ErrNoValidPrivateKey
 	}
 
-	if err := moveKeys(km.KeyStore, tempKeyStore); err != nil {
-		return err
-	}
-
-	zipWriter := zip.NewWriter(dest)
-
-	if err := addKeysToArchive(zipWriter, tempKeyStore, PrivDir); err != nil {
-		return err
-	}
-
-	zipWriter.Close()
-
-	return nil
-}
-
-// ImportKeysZip imports keys from a zip file provided as an zip.Reader. The
-// keys in the root_keys directory are left encrypted, but the other keys are
-// decrypted with the specified passphrase.
-func (km *KeyStoreManager) ImportKeysZip(zipReader zip.Reader) error {
-	// Temporarily store the keys in maps, so we can bail early if there's
-	// an error (for example, wrong passphrase), without leaving the key
-	// store in an inconsistent state
-	newKeys := make(map[string][]byte)
-
-	// Iterate through the files in the archive. Don't add the keys
-	for _, f := range zipReader.File {
-		fNameTrimmed := strings.TrimSuffix(f.Name, filepath.Ext(f.Name))
-
-		rc, err := f.Open()
-		if err != nil {
-			return err
-		}
-
-		fileBytes, err := ioutil.ReadAll(rc)
-		if err != nil {
-			return nil
-		}
-
-		// Note that using / as a separator is okay here - the zip
-		// package guarantees that the separator will be /
-		if strings.HasPrefix(fNameTrimmed, PrivDir) {
-			if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
-				if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
-					rc.Close()
-					return err
-				}
-			}
-			keyName := strings.TrimPrefix(fNameTrimmed, PrivDir)
-			newKeys[keyName] = fileBytes
-		} else {
-			// This path inside the zip archive doesn't look like a
-			// root key, non-root key, or alias. To avoid adding a file
-			// to the filestore that we won't be able to use, skip
-			// this file in the import.
-			rc.Close()
-			continue
-		}
-
-		rc.Close()
-	}
-
-	for keyName, pemBytes := range newKeys {
-		if err := km.KeyStore.Add(keyName, pemBytes); err != nil {
-			return err
-		}
+	if !x509.IsEncryptedPEMBlock(block) {
+		return ErrRootKeyNotEncrypted
 	}
 
 	return nil
 }
-
-func moveKeysByGUN(oldKeyStore, newKeyStore *trustmanager.KeyFileStore, gun string) error {
-	for relKeyPath := range oldKeyStore.ListKeys() {
-		// Skip keys that aren't associated with this GUN
-		if !strings.HasPrefix(relKeyPath, filepath.FromSlash(gun)) {
-			continue
-		}
-
-		privKey, alias, err := oldKeyStore.GetKey(relKeyPath)
-		if err != nil {
-			return err
-		}
-
-		err = newKeyStore.AddKey(relKeyPath, alias, privKey)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// ExportKeysByGUN exports all keys associated with a specified GUN to an
-// io.Writer in zip format. passphraseRetriever is used to select new passphrases to use to
-// encrypt the keys.
-func (km *KeyStoreManager) ExportKeysByGUN(dest io.Writer, gun string, passphraseRetriever passphrase.Retriever) error {
-	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
-	defer os.RemoveAll(tempBaseDir)
-
-	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, PrivDir)
-	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, passphraseRetriever)
-	if err != nil {
-		return err
-	}
-
-	if err := moveKeysByGUN(km.KeyStore, tempKeyStore, gun); err != nil {
-		return err
-	}
-
-	zipWriter := zip.NewWriter(dest)
-
-	if len(tempKeyStore.ListKeys()) == 0 {
-		return ErrNoKeysFoundForGUN
-	}
-
-	if err := addKeysToArchive(zipWriter, tempKeyStore, PrivDir); err != nil {
-		return err
-	}
-
-	zipWriter.Close()
-
-	return nil
-}
diff --git a/cryptoservice/import_export_test.go b/cryptoservice/import_export_test.go
new file mode 100644
index 0000000000..1db796696d
--- /dev/null
+++ b/cryptoservice/import_export_test.go
@@ -0,0 +1,447 @@
+package cryptoservice
+
+//import (
+//	"archive/zip"
+//	"bytes"
+//	"fmt"
+//	"io/ioutil"
+//	"net/http"
+//	"net/http/httptest"
+//	"os"
+//	"path/filepath"
+//	"strings"
+//	"testing"
+//
+//	"github.com/docker/notary/client"
+//	"github.com/docker/notary/keystoremanager"
+//	"github.com/docker/notary/trustmanager"
+//	"github.com/docker/notary/tuf/data"
+//	"github.com/stretchr/testify/assert"
+//)
+//
+//const timestampECDSAKeyJSON = `
+//{"keytype":"ecdsa","keyval":{"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw==","private":"MHcCAQEEIDqtcdzU7H3AbIPSQaxHl9+xYECt7NpK7B1+6ep5cv9CoAoGCCqGSM49AwEHoUQDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}`
+//
+//func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
+//	mux := http.NewServeMux()
+//	// TUF will request /v2/docker.com/notary/_trust/tuf/timestamp.key
+//	// Return a canned timestamp.key
+//	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.key", func(w http.ResponseWriter, r *http.Request) {
+//		// Also contains the private key, but for the purpose of this
+//		// test, we don't care
+//		fmt.Fprint(w, timestampECDSAKeyJSON)
+//	})
+//
+//	ts := httptest.NewServer(mux)
+//
+//	return ts, mux
+//}
+//
+//var oldPassphrase = "oldPassphrase"
+//var exportPassphrase = "exportPassphrase"
+//var oldPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return oldPassphrase, false, nil }
+//var newPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return exportPassphrase, false, nil }
+//
+//func TestImportExportZip(t *testing.T) {
+//	gun := "docker.com/notary"
+//
+//	// Temporary directory where test files will be created
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	ts, _ := createTestServer(t)
+//	defer ts.Close()
+//
+//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo.Initialize(rootKeyID)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
+//	tempZipFilePath := tempZipFile.Name()
+//	defer os.Remove(tempZipFilePath)
+//
+//	err = repo.KeyStoreManager.ExportAllKeys(tempZipFile, newPassphraseRetriever)
+//	tempZipFile.Close()
+//	assert.NoError(t, err)
+//
+//	// Reopen the zip file for importing
+//	zipReader, err := zip.OpenReader(tempZipFilePath)
+//	assert.NoError(t, err, "could not open zip file")
+//
+//	// Map of files to expect in the zip file, with the passphrases
+//	passphraseByFile := make(map[string]string)
+//
+//	// Add non-root keys to the map. These should use the new passphrase
+//	// because the passwords were chosen by the newPassphraseRetriever.
+//	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
+//	for privKeyName := range privKeyMap {
+//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
+//		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
+//
+//		if alias == "root" {
+//			continue
+//		}
+//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+//		passphraseByFile[relKeyPath] = exportPassphrase
+//	}
+//
+//	// Add root key to the map. This will use the export passphrase because it
+//	// will be reencrypted.
+//	relRootKey := filepath.Join("private", "root_keys", rootKeyID+"_root.key")
+//	passphraseByFile[relRootKey] = exportPassphrase
+//
+//	// Iterate through the files in the archive, checking that the files
+//	// exist and are encrypted with the expected passphrase.
+//	for _, f := range zipReader.File {
+//		expectedPassphrase, present := passphraseByFile[f.Name]
+//		if !present {
+//			t.Fatalf("unexpected file %s in zip file", f.Name)
+//		}
+//
+//		delete(passphraseByFile, f.Name)
+//
+//		rc, err := f.Open()
+//		assert.NoError(t, err, "could not open file inside zip archive")
+//
+//		pemBytes, err := ioutil.ReadAll(rc)
+//		assert.NoError(t, err, "could not read file from zip")
+//
+//		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
+//		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
+//
+//		rc.Close()
+//	}
+//
+//	zipReader.Close()
+//
+//	// Are there any keys that didn't make it to the zip?
+//	for fileNotFound := range passphraseByFile {
+//		t.Fatalf("%s not found in zip", fileNotFound)
+//	}
+//
+//	// Create new repo to test import
+//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir2)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo2.Initialize(rootKeyID2)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	// Reopen the zip file for importing
+//	zipReader, err = zip.OpenReader(tempZipFilePath)
+//	assert.NoError(t, err, "could not open zip file")
+//
+//	// Now try with a valid passphrase. This time it should succeed.
+//	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
+//	assert.NoError(t, err)
+//	zipReader.Close()
+//
+//	// Look for keys in private. The filenames should match the key IDs
+//	// in the repo's private key store.
+//	for privKeyName := range privKeyMap {
+//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
+//		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
+//
+//		if alias == "root" {
+//			continue
+//		}
+//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+//		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+//		_, err = os.Stat(privKeyFileName)
+//		assert.NoError(t, err, "missing private key: %s", privKeyName)
+//	}
+//
+//	// Look for keys in root_keys
+//	// There should be a file named after the key ID of the root key we
+//	// passed in.
+//	rootKeyFilename := rootKeyID + "_root.key"
+//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+//	assert.NoError(t, err, "missing root key")
+//}
+//
+//func TestImportExportGUN(t *testing.T) {
+//	gun := "docker.com/notary"
+//
+//	// Temporary directory where test files will be created
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	ts, _ := createTestServer(t)
+//	defer ts.Close()
+//
+//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo.Initialize(rootKeyID)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
+//	tempZipFilePath := tempZipFile.Name()
+//	defer os.Remove(tempZipFilePath)
+//
+//	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, gun, newPassphraseRetriever)
+//	assert.NoError(t, err)
+//
+//	// With an invalid GUN, this should return an error
+//	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, "does.not.exist/in/repository", newPassphraseRetriever)
+//	assert.EqualError(t, err, keystoremanager.ErrNoKeysFoundForGUN.Error())
+//
+//	tempZipFile.Close()
+//
+//	// Reopen the zip file for importing
+//	zipReader, err := zip.OpenReader(tempZipFilePath)
+//	assert.NoError(t, err, "could not open zip file")
+//
+//	// Map of files to expect in the zip file, with the passphrases
+//	passphraseByFile := make(map[string]string)
+//
+//	// Add keys non-root keys to the map. These should use the new passphrase
+//	// because they were formerly unencrypted.
+//	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
+//	for privKeyName := range privKeyMap {
+//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
+//		if err != nil {
+//			t.Fatalf("privKey %s has no alias", privKeyName)
+//		}
+//		if alias == "root" {
+//			continue
+//		}
+//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+//
+//		passphraseByFile[relKeyPath] = exportPassphrase
+//	}
+//
+//	// Iterate through the files in the archive, checking that the files
+//	// exist and are encrypted with the expected passphrase.
+//	for _, f := range zipReader.File {
+//
+//		expectedPassphrase, present := passphraseByFile[f.Name]
+//		if !present {
+//			t.Fatalf("unexpected file %s in zip file", f.Name)
+//		}
+//
+//		delete(passphraseByFile, f.Name)
+//
+//		rc, err := f.Open()
+//		assert.NoError(t, err, "could not open file inside zip archive")
+//
+//		pemBytes, err := ioutil.ReadAll(rc)
+//		assert.NoError(t, err, "could not read file from zip")
+//
+//		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
+//		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
+//
+//		rc.Close()
+//	}
+//
+//	zipReader.Close()
+//
+//	// Are there any keys that didn't make it to the zip?
+//	for fileNotFound := range passphraseByFile {
+//		t.Fatalf("%s not found in zip", fileNotFound)
+//	}
+//
+//	// Create new repo to test import
+//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir2)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo2.Initialize(rootKeyID2)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	// Reopen the zip file for importing
+//	zipReader, err = zip.OpenReader(tempZipFilePath)
+//	assert.NoError(t, err, "could not open zip file")
+//
+//	// Now try with a valid passphrase. This time it should succeed.
+//	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
+//	assert.NoError(t, err)
+//	zipReader.Close()
+//
+//	// Look for keys in private. The filenames should match the key IDs
+//	// in the repo's private key store.
+//	for privKeyName := range privKeyMap {
+//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
+//		if err != nil {
+//			t.Fatalf("privKey %s has no alias", privKeyName)
+//		}
+//		if alias == "root" {
+//			continue
+//		}
+//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+//		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+//		_, err = os.Stat(privKeyFileName)
+//	}
+//}
+//
+//func TestImportExportRootKey(t *testing.T) {
+//	gun := "docker.com/notary"
+//
+//	// Temporary directory where test files will be created
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	ts, _ := createTestServer(t)
+//	defer ts.Close()
+//
+//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo.Initialize(rootKeyID)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
+//	tempKeyFilePath := tempKeyFile.Name()
+//	defer os.Remove(tempKeyFilePath)
+//
+//	err = repo.KeyStoreManager.ExportRootKey(tempKeyFile, rootKeyID)
+//	assert.NoError(t, err)
+//	tempKeyFile.Close()
+//
+//	// Create new repo to test import
+//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir2)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo2.Initialize(rootKeyID2)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	keyReader, err := os.Open(tempKeyFilePath)
+//	assert.NoError(t, err, "could not open key file")
+//
+//	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
+//	assert.NoError(t, err)
+//	keyReader.Close()
+//
+//	// Look for repo's root key in repo2
+//	// There should be a file named after the key ID of the root key we
+//	// imported.
+//	rootKeyFilename := rootKeyID + "_root.key"
+//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+//	assert.NoError(t, err, "missing root key")
+//
+//	// Try to import a decrypted version of the root key and make sure it
+//	// doesn't succeed
+//	pemBytes, err := ioutil.ReadFile(tempKeyFilePath)
+//	assert.NoError(t, err, "could not read key file")
+//	privKey, err := trustmanager.ParsePEMPrivateKey(pemBytes, oldPassphrase)
+//	assert.NoError(t, err, "could not decrypt key file")
+//	decryptedPEMBytes, err := trustmanager.KeyToPEM(privKey)
+//	assert.NoError(t, err, "could not convert key to PEM")
+//
+//	err = repo2.KeyStoreManager.ImportRootKey(bytes.NewReader(decryptedPEMBytes))
+//	assert.EqualError(t, err, keystoremanager.ErrRootKeyNotEncrypted.Error())
+//
+//	// Try to import garbage and make sure it doesn't succeed
+//	err = repo2.KeyStoreManager.ImportRootKey(strings.NewReader("this is not PEM"))
+//	assert.EqualError(t, err, keystoremanager.ErrNoValidPrivateKey.Error())
+//
+//	// Should be able to unlock the root key with the old password
+//	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
+//	assert.NoError(t, err, "could not unlock root key")
+//	assert.Equal(t, "root", alias)
+//	assert.Equal(t, rootKeyID, key.ID())
+//}
+//
+//func TestImportExportRootKeyReencrypt(t *testing.T) {
+//	gun := "docker.com/notary"
+//
+//	// Temporary directory where test files will be created
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	ts, _ := createTestServer(t)
+//	defer ts.Close()
+//
+//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo.Initialize(rootKeyID)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
+//	tempKeyFilePath := tempKeyFile.Name()
+//	defer os.Remove(tempKeyFilePath)
+//
+//	err = repo.KeyStoreManager.ExportRootKeyReencrypt(tempKeyFile, rootKeyID, newPassphraseRetriever)
+//	assert.NoError(t, err)
+//	tempKeyFile.Close()
+//
+//	// Create new repo to test import
+//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir2)
+//
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
+//	assert.NoError(t, err, "error creating repo: %s", err)
+//
+//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
+//	assert.NoError(t, err, "error generating root key: %s", err)
+//
+//	err = repo2.Initialize(rootKeyID2)
+//	assert.NoError(t, err, "error creating repository: %s", err)
+//
+//	keyReader, err := os.Open(tempKeyFilePath)
+//	assert.NoError(t, err, "could not open key file")
+//
+//	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
+//	assert.NoError(t, err)
+//	keyReader.Close()
+//
+//	// Look for repo's root key in repo2
+//	// There should be a file named after the key ID of the root key we
+//	// imported.
+//	rootKeyFilename := rootKeyID + "_root.key"
+//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+//	assert.NoError(t, err, "missing root key")
+//
+//	// Should be able to unlock the root key with the new password
+//	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
+//	assert.NoError(t, err, "could not unlock root key")
+//	assert.Equal(t, "root", alias)
+//	assert.Equal(t, rootKeyID, key.ID())
+//}
diff --git a/keystoremanager/import_export_test.go b/keystoremanager/import_export_test.go
deleted file mode 100644
index afbf2e8c8e..0000000000
--- a/keystoremanager/import_export_test.go
+++ /dev/null
@@ -1,447 +0,0 @@
-package keystoremanager_test
-
-import (
-	"archive/zip"
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/docker/notary/client"
-	"github.com/docker/notary/keystoremanager"
-	"github.com/docker/notary/trustmanager"
-	"github.com/docker/notary/tuf/data"
-	"github.com/stretchr/testify/assert"
-)
-
-const timestampECDSAKeyJSON = `
-{"keytype":"ecdsa","keyval":{"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw==","private":"MHcCAQEEIDqtcdzU7H3AbIPSQaxHl9+xYECt7NpK7B1+6ep5cv9CoAoGCCqGSM49AwEHoUQDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}`
-
-func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
-	mux := http.NewServeMux()
-	// TUF will request /v2/docker.com/notary/_trust/tuf/timestamp.key
-	// Return a canned timestamp.key
-	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.key", func(w http.ResponseWriter, r *http.Request) {
-		// Also contains the private key, but for the purpose of this
-		// test, we don't care
-		fmt.Fprint(w, timestampECDSAKeyJSON)
-	})
-
-	ts := httptest.NewServer(mux)
-
-	return ts, mux
-}
-
-var oldPassphrase = "oldPassphrase"
-var exportPassphrase = "exportPassphrase"
-var oldPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return oldPassphrase, false, nil }
-var newPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return exportPassphrase, false, nil }
-
-func TestImportExportZip(t *testing.T) {
-	gun := "docker.com/notary"
-
-	// Temporary directory where test files will be created
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	ts, _ := createTestServer(t)
-	defer ts.Close()
-
-	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
-	tempZipFilePath := tempZipFile.Name()
-	defer os.Remove(tempZipFilePath)
-
-	err = repo.KeyStoreManager.ExportAllKeys(tempZipFile, newPassphraseRetriever)
-	tempZipFile.Close()
-	assert.NoError(t, err)
-
-	// Reopen the zip file for importing
-	zipReader, err := zip.OpenReader(tempZipFilePath)
-	assert.NoError(t, err, "could not open zip file")
-
-	// Map of files to expect in the zip file, with the passphrases
-	passphraseByFile := make(map[string]string)
-
-	// Add non-root keys to the map. These should use the new passphrase
-	// because the passwords were chosen by the newPassphraseRetriever.
-	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
-	for privKeyName := range privKeyMap {
-		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
-
-		if alias == "root" {
-			continue
-		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-		passphraseByFile[relKeyPath] = exportPassphrase
-	}
-
-	// Add root key to the map. This will use the export passphrase because it
-	// will be reencrypted.
-	relRootKey := filepath.Join("private", "root_keys", rootKeyID+"_root.key")
-	passphraseByFile[relRootKey] = exportPassphrase
-
-	// Iterate through the files in the archive, checking that the files
-	// exist and are encrypted with the expected passphrase.
-	for _, f := range zipReader.File {
-		expectedPassphrase, present := passphraseByFile[f.Name]
-		if !present {
-			t.Fatalf("unexpected file %s in zip file", f.Name)
-		}
-
-		delete(passphraseByFile, f.Name)
-
-		rc, err := f.Open()
-		assert.NoError(t, err, "could not open file inside zip archive")
-
-		pemBytes, err := ioutil.ReadAll(rc)
-		assert.NoError(t, err, "could not read file from zip")
-
-		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
-		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
-
-		rc.Close()
-	}
-
-	zipReader.Close()
-
-	// Are there any keys that didn't make it to the zip?
-	for fileNotFound := range passphraseByFile {
-		t.Fatalf("%s not found in zip", fileNotFound)
-	}
-
-	// Create new repo to test import
-	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir2)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo2.Initialize(rootKeyID2)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	// Reopen the zip file for importing
-	zipReader, err = zip.OpenReader(tempZipFilePath)
-	assert.NoError(t, err, "could not open zip file")
-
-	// Now try with a valid passphrase. This time it should succeed.
-	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
-	assert.NoError(t, err)
-	zipReader.Close()
-
-	// Look for keys in private. The filenames should match the key IDs
-	// in the repo's private key store.
-	for privKeyName := range privKeyMap {
-		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
-
-		if alias == "root" {
-			continue
-		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
-		_, err = os.Stat(privKeyFileName)
-		assert.NoError(t, err, "missing private key: %s", privKeyName)
-	}
-
-	// Look for keys in root_keys
-	// There should be a file named after the key ID of the root key we
-	// passed in.
-	rootKeyFilename := rootKeyID + "_root.key"
-	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-	assert.NoError(t, err, "missing root key")
-}
-
-func TestImportExportGUN(t *testing.T) {
-	gun := "docker.com/notary"
-
-	// Temporary directory where test files will be created
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	ts, _ := createTestServer(t)
-	defer ts.Close()
-
-	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
-	tempZipFilePath := tempZipFile.Name()
-	defer os.Remove(tempZipFilePath)
-
-	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, gun, newPassphraseRetriever)
-	assert.NoError(t, err)
-
-	// With an invalid GUN, this should return an error
-	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, "does.not.exist/in/repository", newPassphraseRetriever)
-	assert.EqualError(t, err, keystoremanager.ErrNoKeysFoundForGUN.Error())
-
-	tempZipFile.Close()
-
-	// Reopen the zip file for importing
-	zipReader, err := zip.OpenReader(tempZipFilePath)
-	assert.NoError(t, err, "could not open zip file")
-
-	// Map of files to expect in the zip file, with the passphrases
-	passphraseByFile := make(map[string]string)
-
-	// Add keys non-root keys to the map. These should use the new passphrase
-	// because they were formerly unencrypted.
-	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
-	for privKeyName := range privKeyMap {
-		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-		if err != nil {
-			t.Fatalf("privKey %s has no alias", privKeyName)
-		}
-		if alias == "root" {
-			continue
-		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-
-		passphraseByFile[relKeyPath] = exportPassphrase
-	}
-
-	// Iterate through the files in the archive, checking that the files
-	// exist and are encrypted with the expected passphrase.
-	for _, f := range zipReader.File {
-
-		expectedPassphrase, present := passphraseByFile[f.Name]
-		if !present {
-			t.Fatalf("unexpected file %s in zip file", f.Name)
-		}
-
-		delete(passphraseByFile, f.Name)
-
-		rc, err := f.Open()
-		assert.NoError(t, err, "could not open file inside zip archive")
-
-		pemBytes, err := ioutil.ReadAll(rc)
-		assert.NoError(t, err, "could not read file from zip")
-
-		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
-		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
-
-		rc.Close()
-	}
-
-	zipReader.Close()
-
-	// Are there any keys that didn't make it to the zip?
-	for fileNotFound := range passphraseByFile {
-		t.Fatalf("%s not found in zip", fileNotFound)
-	}
-
-	// Create new repo to test import
-	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir2)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo2.Initialize(rootKeyID2)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	// Reopen the zip file for importing
-	zipReader, err = zip.OpenReader(tempZipFilePath)
-	assert.NoError(t, err, "could not open zip file")
-
-	// Now try with a valid passphrase. This time it should succeed.
-	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
-	assert.NoError(t, err)
-	zipReader.Close()
-
-	// Look for keys in private. The filenames should match the key IDs
-	// in the repo's private key store.
-	for privKeyName := range privKeyMap {
-		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-		if err != nil {
-			t.Fatalf("privKey %s has no alias", privKeyName)
-		}
-		if alias == "root" {
-			continue
-		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
-		_, err = os.Stat(privKeyFileName)
-	}
-}
-
-func TestImportExportRootKey(t *testing.T) {
-	gun := "docker.com/notary"
-
-	// Temporary directory where test files will be created
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	ts, _ := createTestServer(t)
-	defer ts.Close()
-
-	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
-	tempKeyFilePath := tempKeyFile.Name()
-	defer os.Remove(tempKeyFilePath)
-
-	err = repo.KeyStoreManager.ExportRootKey(tempKeyFile, rootKeyID)
-	assert.NoError(t, err)
-	tempKeyFile.Close()
-
-	// Create new repo to test import
-	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir2)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo2.Initialize(rootKeyID2)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	keyReader, err := os.Open(tempKeyFilePath)
-	assert.NoError(t, err, "could not open key file")
-
-	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
-	assert.NoError(t, err)
-	keyReader.Close()
-
-	// Look for repo's root key in repo2
-	// There should be a file named after the key ID of the root key we
-	// imported.
-	rootKeyFilename := rootKeyID + "_root.key"
-	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-	assert.NoError(t, err, "missing root key")
-
-	// Try to import a decrypted version of the root key and make sure it
-	// doesn't succeed
-	pemBytes, err := ioutil.ReadFile(tempKeyFilePath)
-	assert.NoError(t, err, "could not read key file")
-	privKey, err := trustmanager.ParsePEMPrivateKey(pemBytes, oldPassphrase)
-	assert.NoError(t, err, "could not decrypt key file")
-	decryptedPEMBytes, err := trustmanager.KeyToPEM(privKey)
-	assert.NoError(t, err, "could not convert key to PEM")
-
-	err = repo2.KeyStoreManager.ImportRootKey(bytes.NewReader(decryptedPEMBytes))
-	assert.EqualError(t, err, keystoremanager.ErrRootKeyNotEncrypted.Error())
-
-	// Try to import garbage and make sure it doesn't succeed
-	err = repo2.KeyStoreManager.ImportRootKey(strings.NewReader("this is not PEM"))
-	assert.EqualError(t, err, keystoremanager.ErrNoValidPrivateKey.Error())
-
-	// Should be able to unlock the root key with the old password
-	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
-	assert.NoError(t, err, "could not unlock root key")
-	assert.Equal(t, "root", alias)
-	assert.Equal(t, rootKeyID, key.ID())
-}
-
-func TestImportExportRootKeyReencrypt(t *testing.T) {
-	gun := "docker.com/notary"
-
-	// Temporary directory where test files will be created
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	ts, _ := createTestServer(t)
-	defer ts.Close()
-
-	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo.Initialize(rootKeyID)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
-	tempKeyFilePath := tempKeyFile.Name()
-	defer os.Remove(tempKeyFilePath)
-
-	err = repo.KeyStoreManager.ExportRootKeyReencrypt(tempKeyFile, rootKeyID, newPassphraseRetriever)
-	assert.NoError(t, err)
-	tempKeyFile.Close()
-
-	// Create new repo to test import
-	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir2)
-
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
-	assert.NoError(t, err, "error creating repo: %s", err)
-
-	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-	assert.NoError(t, err, "error generating root key: %s", err)
-
-	err = repo2.Initialize(rootKeyID2)
-	assert.NoError(t, err, "error creating repository: %s", err)
-
-	keyReader, err := os.Open(tempKeyFilePath)
-	assert.NoError(t, err, "could not open key file")
-
-	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
-	assert.NoError(t, err)
-	keyReader.Close()
-
-	// Look for repo's root key in repo2
-	// There should be a file named after the key ID of the root key we
-	// imported.
-	rootKeyFilename := rootKeyID + "_root.key"
-	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-	assert.NoError(t, err, "missing root key")
-
-	// Should be able to unlock the root key with the new password
-	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
-	assert.NoError(t, err, "could not unlock root key")
-	assert.Equal(t, "root", alias)
-	assert.Equal(t, rootKeyID, key.ID())
-}
diff --git a/keystoremanager/keystoremanager_test.go b/keystoremanager/keystoremanager_test.go
index bae645bdac..da19c08ad5 100644
--- a/keystoremanager/keystoremanager_test.go
+++ b/keystoremanager/keystoremanager_test.go
@@ -1,435 +1,435 @@
 package keystoremanager
 
-import (
-	"bytes"
-	"crypto/x509"
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-	"text/template"
-
-	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/trustmanager"
-	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/signed"
-	"github.com/stretchr/testify/assert"
-)
-
-type SignedRSARootTemplate struct {
-	RootPem string
-}
-
-var passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "passphrase", false, nil }
-
-const validPEMEncodedRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZLekNDQXhXZ0F3SUJBZ0lRUnlwOVFxY0pmZDNheXFkaml6OHhJREFMQmdrcWhraUc5dzBCQVFzd09ERWEKTUJnR0ExVUVDaE1SWkc5amEyVnlMbU52YlM5dWIzUmhjbmt4R2pBWUJnTlZCQU1URVdSdlkydGxjaTVqYjIwdgpibTkwWVhKNU1CNFhEVEUxTURjeE56QTJNelF5TTFvWERURTNNRGN4TmpBMk16UXlNMW93T0RFYU1CZ0dBMVVFCkNoTVJaRzlqYTJWeUxtTnZiUzl1YjNSaGNua3hHakFZQmdOVkJBTVRFV1J2WTJ0bGNpNWpiMjB2Ym05MFlYSjUKTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUFvUWZmcnpzWW5zSDh2R2Y0Smg1NQpDajV3cmpVR3pEL3NIa2FGSHB0ako2VG9KR0p2NXlNQVB4enlJbnU1c0lvR0xKYXBuWVZCb0FVMFlnSTlxbEFjCllBNlN4YVN3Z202cnB2bW5sOFFuMHFjNmdlcjNpbnBHYVVKeWxXSHVQd1drdmNpbVFBcUhaeDJkUXRMN2c2a3AKcm1LZVRXcFdvV0x3M0pvQVVaVVZoWk1kNmEyMlpML0R2QXcrSHJvZ2J6NFhleWFoRmI5SUg0MDJ6UHhONnZnYQpKRUZURjBKaTFqdE5nME1vNHBiOVNIc01zaXcrTFpLN1NmZkhWS1B4dmQyMW0vYmlObXdzZ0V4QTNVOE9PRzhwCnV5Z2ZhY3lzNWM4K1pyWCtaRkcvY3Z3S3owazYvUWZKVTQwczZNaFh3NUMyV3R0ZFZtc0c5LzdyR0ZZakhvSUoKd2VEeXhnV2s3dnhLelJKSS91bjdjYWdESWFRc0tySlFjQ0hJR0ZSbHBJUjVUd1g3dmwzUjdjUm5jckRSTVZ2YwpWU0VHMmVzeGJ3N2p0eklwL3lwblZSeGNPbnk3SXlweWpLcVZlcVo2SGd4WnRUQlZyRjFPL2FIbzJrdmx3eVJTCkF1czRrdmg2ejMranpUbTlFemZYaVBRelk5QkVrNWdPTHhoVzlyYzZVaGxTK3BlNWxrYU4vSHlxeS9sUHVxODkKZk1yMnJyN2xmNVdGZEZuemU2V05ZTUFhVzdkTkE0TkUwZHlENTM0MjhaTFh4TlZQTDRXVTY2R2FjNmx5blE4bApyNXRQc1lJRlh6aDZGVmFSS0dRVXRXMWh6OWVjTzZZMjdSaDJKc3lpSXhnVXFrMm9veEU2OXVONDJ0K2R0cUtDCjFzOEcvN1Z0WThHREFMRkxZVG56THZzQ0F3RUFBYU0xTURNd0RnWURWUjBQQVFIL0JBUURBZ0NnTUJNR0ExVWQKSlFRTU1Bb0dDQ3NHQVFVRkJ3TURNQXdHQTFVZEV3RUIvd1FDTUFBd0N3WUpLb1pJaHZjTkFRRUxBNElDQVFCTQpPbGwzRy9YQno4aWRpTmROSkRXVWgrNXczb2ptd2FuclRCZENkcUVrMVdlbmFSNkR0Y2ZsSng2WjNmL213VjRvCmIxc2tPQVgxeVg1UkNhaEpIVU14TWljei9RMzhwT1ZlbEdQclduYzNUSkIrVktqR3lIWGxRRFZrWkZiKzQrZWYKd3RqN0huZ1hoSEZGRFNnam0zRWRNbmR2Z0RRN1NRYjRza09uQ05TOWl5WDdlWHhoRkJDWm1aTCtIQUxLQmoyQgp5aFY0SWNCRHFtcDUwNHQxNHJ4OS9KdnR5MGRHN2ZZN0k1MWdFUXBtNFMwMkpNTDV4dlRtMXhmYm9XSWhaT0RJCnN3RUFPK2VrQm9GSGJTMVE5S01QaklBdzNUckNISDh4OFhacTV6c1l0QUMxeVpIZENLYTI2YVdkeTU2QTllSGoKTzFWeHp3bWJOeVhSZW5WdUJZUCswd3IzSFZLRkc0Sko0WlpwTlp6UVcvcHFFUGdoQ1RKSXZJdWVLNjUyQnlVYwovL3N2K25YZDVmMTlMZUVTOXBmMGwyNTNORGFGWlBiNmFlZ0tmcXVXaDhxbFFCbVVRMkd6YVRMYnRtTmQyOE02Clc3aUw3dGtLWmUxWm5CejlSS2d0UHJEampXR1pJbmpqY09VOEV0VDRTTHE3a0NWRG1QczVNRDh2YUFtOTZKc0UKam1MQzNVdS80azdIaURZWDBpMG1PV2tGalpRTWRWYXRjSUY1RlBTcHB3c1NiVzhRaWRuWHQ1NFV0d3RGREVQegpscGpzN3liZVFFNzFKWGNNWm5WSUs0YmpSWHNFRlBJOThScElsRWRlZGJTVWRZQW5jTE5KUlQ3SFpCTVBHU3daCjBQTkp1Z2xubHIzc3JWemRXMWR6MnhRamR2THd4eTZtTlVGNnJiUUJXQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K`
-
-const validCAPEMEncodeRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg==`
-
-const validIntermediateAndCertRSA = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQ0KTUlJRlZ6Q0NBeitnQXdJQkFnSUJBekFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUm93R0FZRFZRUUREQkZPYjNSaA0KY25rZ1ZHVnpkR2x1WnlCRFFURUxNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJseg0KWTI4eER6QU5CZ05WQkFvTUJrUnZZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdIaGNOTVRVd056RTJNRFF5TlRVdw0KV2hjTk1UWXdOekUxTURReU5UVXdXakJnTVJzd0dRWURWUVFEREJKelpXTjFjbVV1WlhoaGJYQnNaUzVqYjIweA0KQ3pBSkJnTlZCQVlUQWxWVE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRQ0KYjJOclpYSXhDekFKQmdOVkJBZ01Ba05CTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQw0KQVFFQW1MWWlZQ1RBV0pCV0F1eFpMcVZtVjRGaVVkR2dFcW9RdkNiTjczekYvbVFmaHEwQ0lUbzZ4U3hzMVFpRw0KRE96VXRrcHpYenppU2o0SjUrZXQ0SmtGbGVlRUthTWNIYWRlSXNTbEhHdlZ0WER2OTNvUjN5ZG1mWk8rVUxSVQ0KOHhIbG9xY0xyMUtyT1AxZGFMZmRNUmJhY3RkNzVVUWd2dzlYVHNkZU1WWDVBbGljU0VOVktWK0FRWHZWcHY4UA0KVDEwTVN2bEJGYW00cmVYdVkvU2tlTWJJYVc1cEZ1NkFRdjNabWZ0dDJ0YTBDQjlrYjFtWWQrT0tydThIbm5xNQ0KYUp3NlIzR2hQMFRCZDI1UDFQa2lTeE0yS0dZWlprMFcvTlpxTEs5L0xURktUTkN2N1ZqQ2J5c1ZvN0h4Q1kwYg0KUWUvYkRQODJ2N1NuTHRiM2Fab2dmdmE0SFFJREFRQUJvNElCR3pDQ0FSY3dnWWdHQTFVZEl3U0JnREIrZ0JSMw0KdVBJWEFYQUtkRzFGWlU4VjNrUU9LQk5lcWFGanBHRXdYekVMTUFrR0ExVUVCaE1DVlZNeEN6QUpCZ05WQkFnTQ0KQWtOQk1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRWIyTnJaWEl4R2pBWQ0KQmdOVkJBTU1FVTV2ZEdGeWVTQlVaWE4wYVc1bklFTkJnZ0VCTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwbA0KQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQTRHQTFVZER3RUIvd1FFQXdJRm9EQXVCZ05WSFJFRQ0KSnpBbGdoSnpaV04xY21VdVpYaGhiWEJzWlM1amIyMkNDV3h2WTJGc2FHOXpkSWNFZndBQUFUQWRCZ05WSFE0RQ0KRmdRVURQRDRDYVhSYnU1UUJiNWU4eThvZHZUcVc0SXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSk95bG1jNA0KbjdKNjRHS3NQL3hoVWRLS1Y5L0tEK3VmenBLYnJMSW9qV243clR5ZTcwdlkwT2pRRnVPWGM1NHlqTVNJTCsvNQ0KbWxOUTdZL2ZKUzh4ZEg3OUVSKzRuV011RDJlY2lMbnNMZ2JZVWs0aGl5Ynk4LzVWKy9ZcVBlQ3BQQ242VEpSSw0KYTBFNmxWL1VqWEpkcmlnSnZKb05PUjhaZ3RFWi9RUGdqSkVWVXNnNDdkdHF6c0RwZ2VTOGRjanVNV3BaeFAwMg0KcWF2RkxEalNGelZIKzJENk90eTFEUXBsbS8vM1hhUlhoMjNkT0NQOHdqL2J4dm5WVG9GV3Mrek80dVQxTEYvUw0KS1hDTlFvZWlHeFdIeXpyWEZWVnRWbkM5RlNOejBHZzIvRW0xdGZSZ3ZoVW40S0xKY3ZaVzlvMVI3VlZDWDBMMQ0KMHgwZnlLM1ZXZVdjODZhNWE2ODFhbUtaU0ViakFtSVZaRjl6T1gwUE9EQzhveSt6cU9QV2EwV0NsNEs2ekRDNg0KMklJRkJCTnk1MFpTMmlPTjZSWTZtRTdObUE3OGdja2Y0MTVjcUlWcmxvWUpiYlREZXBmaFRWMjE4U0xlcHBoNA0KdUdiMi9zeGtsZkhPWUUrcnBIY2lpYld3WHJ3bE9ESmFYdXpYRmhwbFVkL292ZHVqQk5BSUhrQmZ6eStZNnoycw0KYndaY2ZxRDROSWIvQUdoSXlXMnZidnU0enNsRHAxTUVzTG9hTytTemlyTXpreU1CbEtSdDEyMHR3czRFa1VsbQ0KL1FoalNVb1pwQ0FzeTVDL3BWNCtieDBTeXNOZC9TK2tLYVJaYy9VNlkzWllCRmhzekxoN0phTFhLbWs3d0huRQ0KcmdnbTZvejRML0d5UFdjL0ZqZm5zZWZXS00yeUMzUURoanZqDQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo=`
-
-const signedRSARootTemplate = `{"signed":{"_type":"Root","consistent_snapshot":false,"expires":"2016-07-16T23:34:13.389129622-07:00","keys":{"1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nIgzLigo5D47dWQe1IUjzHXxvyx0j/OL16VQymuloWsgVDxxT6+mH3CeviMAs+/McnEPE9exnm6SQGR5x3XMw=="}},"23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEClUFVWkc85OQScfTQRS02VaLIEaeCmxdwYS/hcTLVoTxlFfRfs7HyalTwXGAGO79XZZS+koE6s8D0xGcCJQkLQ=="}},"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292":{"keytype":"rsa-x509","keyval":{"private":null,"public":"{{.RootPem}}"}},"e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}},"roles":{"root":{"keyids":["49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292"],"threshold":1},"snapshot":{"keyids":["23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14"],"threshold":1},"targets":{"keyids":["1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670"],"threshold":1},"timestamp":{"keyids":["e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9"],"threshold":1}},"version":2},"signatures":[{"keyid":"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292","method":"rsapss","sig":"YlZwtCj028Xc23+KHfj6govFEY6hMbBXO5HT20F0I5ZeIPb1l7OmkjEiwp9ZHusClY+QeqiP1CFh\n/AfCbv4tLanqMkXPtm8UJJ1hMZVq86coieB32PQDj9k6x1hErHzvPUbOzTRW2BQkFFMZFkLDAd06\npH8lmxyPLOhdkVE8qIT7sBCy/4bQIGfvEX6yCDz84MZdcLNX5B9mzGi9A7gDloh9IEZxA8UgoI18\nSYpv/fYeSZSqM/ws2G+kiELGgTWhcZ+gOlF7ArM/DOlcC/NYqcvY1ugE6Gn7G8opre6NOofdRp3w\n603A2rMMvYTwqKLY6oX/d+07A2+WGHXPUy5otCAybWOw2hIZ35Jjmh12g6Dc6Qk4K2zXwAgvWwBU\nWlT8MlP1Tf7f80jnGjh0aARlHI4LCxlYU5L/pCaYuHgynujvLuzoOuiiPfJv7sYvKoQ8UieE1w//\nHc8E6tWtV5G2FguKLurMoKZ9FBWcanDO0fg5AWuG3qcgUJdvh9acQ33EKer1fqBxs6LSAUWo8rDt\nQkg+b55AW0YBukAW9IAfMySQGAS2e3mHZ8nK/ijaygCRu7/P+NgKY9/zpmfL2xgcNslLcANcSOOt\nhiJS6yqYM9i9G0af0yw/TxAT4ntwjVm8u52UyR/hXIiUc/mjZcYRbSmJOHws902+i+Z/qv72knk="}]}`
-
-func TestCertsToRemove(t *testing.T) {
-	// Get a few certificates to test with
-	cert1, err := trustmanager.LoadCertFromFile("../fixtures/secure.example.com.crt")
-	assert.NoError(t, err)
-	cert1KeyID, err := trustmanager.FingerprintCert(cert1)
-	assert.NoError(t, err)
-
-	// Get intermediate certificate
-	cert2, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_secure.example.com.crt")
-	assert.NoError(t, err)
-	cert2KeyID, err := trustmanager.FingerprintCert(cert2)
-	assert.NoError(t, err)
-
-	// Get leaf certificate
-	cert3, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_docker.com-notary.crt")
-	assert.NoError(t, err)
-	cert3KeyID, err := trustmanager.FingerprintCert(cert3)
-	assert.NoError(t, err)
-
-	// Call CertsToRemove with only one old and one new
-	oldCerts := []*x509.Certificate{cert1}
-	newCerts := []*x509.Certificate{cert2}
-
-	certs := certsToRemove(oldCerts, newCerts)
-	assert.Len(t, certs, 1)
-	_, ok := certs[cert1KeyID]
-	assert.True(t, ok)
-
-	// Call CertsToRemove with two old and one new
-	oldCerts = []*x509.Certificate{cert1, cert2}
-	newCerts = []*x509.Certificate{cert3}
-
-	certs = certsToRemove(oldCerts, newCerts)
-	assert.Len(t, certs, 2)
-	_, ok = certs[cert1KeyID]
-	assert.True(t, ok)
-	_, ok = certs[cert2KeyID]
-	assert.True(t, ok)
-	_, ok = certs[cert3KeyID]
-	assert.False(t, ok)
-
-	// Call CertsToRemove with two new and one old
-	oldCerts = []*x509.Certificate{cert3}
-	newCerts = []*x509.Certificate{cert2, cert1}
-
-	certs = certsToRemove(oldCerts, newCerts)
-	assert.Len(t, certs, 1)
-	_, ok = certs[cert3KeyID]
-	assert.True(t, ok)
-	_, ok = certs[cert1KeyID]
-	assert.False(t, ok)
-	_, ok = certs[cert2KeyID]
-	assert.False(t, ok)
-
-	// Call CertsToRemove with three old certs and no new
-	oldCerts = []*x509.Certificate{cert1, cert2, cert3}
-	newCerts = []*x509.Certificate{}
-
-	certs = certsToRemove(oldCerts, newCerts)
-	assert.Len(t, certs, 0)
-	_, ok = certs[cert1KeyID]
-	assert.False(t, ok)
-	_, ok = certs[cert2KeyID]
-	assert.False(t, ok)
-	_, ok = certs[cert3KeyID]
-	assert.False(t, ok)
-
-	// Call CertsToRemove with three new certs and no old
-	oldCerts = []*x509.Certificate{}
-	newCerts = []*x509.Certificate{cert1, cert2, cert3}
-
-	certs = certsToRemove(oldCerts, newCerts)
-	assert.Len(t, certs, 0)
-	_, ok = certs[cert1KeyID]
-	assert.False(t, ok)
-	_, ok = certs[cert2KeyID]
-	assert.False(t, ok)
-	_, ok = certs[cert3KeyID]
-	assert.False(t, ok)
-
-}
-
-func TestValidateRoot(t *testing.T) {
-	var testSignedRoot data.Signed
-	var signedRootBytes bytes.Buffer
-
-	// Temporary directory where test files will be created
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	defer os.RemoveAll(tempBaseDir)
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	keysPath := filepath.Join(tempBaseDir, PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-	assert.NoError(t, err)
-
-	// Create a FileStoreManager
-	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
-	assert.NoError(t, err)
-
-	// Execute our template
-	templ, _ := template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validPEMEncodedRSARoot})
-
-	// Unmarshal our signedroot
-	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-
-	//
-	// This call to ValidateRoot will succeed since we are using a valid PEM
-	// encoded certificate, and have no other certificates for this CN
-	//
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-	assert.NoError(t, err)
-
-	//
-	// This call to ValidateRoot will fail since we are passing in a dnsName that
-	// doesn't match the CN of the certificate.
-	//
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "diogomonica.com/notary")
-	if assert.Error(t, err, "An error was expected") {
-		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-	}
-
-	//
-	// This call to ValidateRoot will fail since we are passing an unparsable RootSigned
-	//
-	// Execute our template deleting the old buffer first
-	signedRootBytes.Reset()
-	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "------ ABSOLUTELY NOT A PEM -------"})
-	// Unmarshal our signedroot
-	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-	assert.Error(t, err, "illegal base64 data at input byte")
-
-	//
-	// This call to ValidateRoot will fail since we are passing an invalid PEM cert
-	//
-	// Execute our template deleting the old buffer first
-	signedRootBytes.Reset()
-	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "LS0tLS1CRUdJTiBDRVJU"})
-	// Unmarshal our signedroot
-	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-	if assert.Error(t, err, "An error was expected") {
-		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-	}
-
-	//
-	// This call to ValidateRoot will fail since we are passing only CA certificate
-	// This will fail due to the lack of a leaf certificate
-	//
-	// Execute our template deleting the old buffer first
-	signedRootBytes.Reset()
-	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validCAPEMEncodeRSARoot})
-	// Unmarshal our signedroot
-	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-	if assert.Error(t, err, "An error was expected") {
-		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-	}
-
-	//
-	// This call to ValidateRoot will suceed in getting to the TUF validation, since
-	// we are using a valid PEM encoded certificate chain of intermediate + leaf cert
-	// that are signed by a trusted root authority and the leaf cert has a correct CN.
-	// It will, however, fail to validate, because it has an invalid TUF signature
-	//
-	// Execute our template deleting the old buffer first
-	signedRootBytes.Reset()
-	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validIntermediateAndCertRSA})
-
-	// Unmarshal our signedroot
-	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-
-	err = keyStoreManager.ValidateRoot(&testSignedRoot, "secure.example.com")
-	if assert.Error(t, err, "An error was expected") {
-		assert.Equal(t, err, &ErrValidationFail{Reason: "failed to validate integrity of roots"})
-	}
-}
-
-// TestValidateSuccessfulRootRotation runs through a full root certificate rotation
-// We test this with both an RSA and ECDSA root certificate
-func TestValidateSuccessfulRootRotation(t *testing.T) {
-	testValidateSuccessfulRootRotation(t, data.ECDSAKey, data.ECDSAx509Key)
-	if !testing.Short() {
-		testValidateSuccessfulRootRotation(t, data.RSAKey, data.RSAx509Key)
-	}
-}
-
-// Generates a KeyStoreManager in a temporary directory and returns the
-// manager and certificates for two keys which have been added to the keystore.
-// Also returns the temporary directory so it can be cleaned up.
-func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
-	string, *KeyStoreManager, []*x509.Certificate) {
-	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-
-	keysPath := filepath.Join(tempBaseDir, PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-	assert.NoError(t, err)
-
-	// Create a FileStoreManager
-	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
-	assert.NoError(t, err)
-
-	certs := make([]*x509.Certificate, 2)
-	for i := 0; i < 2; i++ {
-		keyID, err := keyStoreManager.GenRootKey(keyAlg)
-		assert.NoError(t, err)
-
-		key, _, err := keyStoreManager.KeyStore.GetKey(keyID)
-		assert.NoError(t, err)
-
-		cert, err := cryptoservice.GenerateCertificate(key, gun)
-		assert.NoError(t, err)
-
-		certs[i] = cert
-	}
-	return tempBaseDir, keyStoreManager, certs
-}
-
-func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string) {
-	// The gun to test
-	gun := "docker.com/notary"
-
-	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-	defer os.RemoveAll(tempBaseDir)
-	origRootCert := certs[0]
-	replRootCert := certs[1]
-
-	// Add the old root cert part of trustedCertificates
-	keyStoreManager.AddTrustedCert(origRootCert)
-
-	// We need the PEM representation of the replacement key to put it into the TUF data
-	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
-	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-
-	// Tuf key with PEM-encoded x509 certificate
-	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
-	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-
-	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-	assert.NoError(t, err)
-
-	testRoot, err := data.NewRoot(
-		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-		map[string]*data.RootRole{"root": &rootRole.RootRole},
-		false,
-	)
-	assert.NoError(t, err, "Failed to create new root")
-
-	signedTestRoot, err := testRoot.ToSigned()
-	assert.NoError(t, err)
-
-	cs := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
-
-	err = signed.Sign(cs, signedTestRoot, replRootKey)
-	assert.NoError(t, err)
-
-	err = signed.Sign(cs, signedTestRoot, origRootKey)
-	assert.NoError(t, err)
-
-	//
-	// This call to ValidateRoot will succeed since we are using a valid PEM
-	// encoded certificate, and have no other certificates for this CN
-	//
-	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-	assert.NoError(t, err)
-
-	// Finally, validate the only trusted certificate that exists is the new one
-	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-	assert.Len(t, certs, 1)
-	assert.Equal(t, certs[0], replRootCert)
-}
-
-// TestValidateRootRotationMissingOrigSig runs through a full root certificate rotation
-// where we are missing the original root key signature. Verification should fail.
-// We test this with both an RSA and ECDSA root certificate
-func TestValidateRootRotationMissingOrigSig(t *testing.T) {
-	testValidateRootRotationMissingOrigSig(t, data.ECDSAKey, data.ECDSAx509Key)
-	if !testing.Short() {
-		testValidateRootRotationMissingOrigSig(t, data.RSAKey, data.RSAx509Key)
-	}
-}
-
-func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType string) {
-	gun := "docker.com/notary"
-
-	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-	defer os.RemoveAll(tempBaseDir)
-	origRootCert := certs[0]
-	replRootCert := certs[1]
-
-	// Add the old root cert part of trustedCertificates
-	keyStoreManager.AddTrustedCert(origRootCert)
-
-	// We need the PEM representation of the replacement key to put it into the TUF data
-	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-
-	// Tuf key with PEM-encoded x509 certificate
-	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-
-	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-	assert.NoError(t, err)
-
-	testRoot, err := data.NewRoot(
-		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-		map[string]*data.RootRole{"root": &rootRole.RootRole},
-		false,
-	)
-	assert.NoError(t, err, "Failed to create new root")
-
-	signedTestRoot, err := testRoot.ToSigned()
-	assert.NoError(t, err)
-
-	// We only sign with the new key, and not with the original one.
-	err = signed.Sign(
-		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
-		signedTestRoot, replRootKey)
-	assert.NoError(t, err)
-
-	//
-	// This call to ValidateRoot will succeed since we are using a valid PEM
-	// encoded certificate, and have no other certificates for this CN
-	//
-	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-	assert.Error(t, err, "insuficient signatures on root")
-
-	// Finally, validate the only trusted certificate that exists is still
-	// the old one
-	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-	assert.Len(t, certs, 1)
-	assert.Equal(t, certs[0], origRootCert)
-}
-
-// TestValidateRootRotationMissingNewSig runs through a full root certificate rotation
-// where we are missing the new root key signature. Verification should fail.
-// We test this with both an RSA and ECDSA root certificate
-func TestValidateRootRotationMissingNewSig(t *testing.T) {
-	testValidateRootRotationMissingNewSig(t, data.ECDSAKey, data.ECDSAx509Key)
-	if !testing.Short() {
-		testValidateRootRotationMissingNewSig(t, data.RSAKey, data.RSAx509Key)
-	}
-}
-
-func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType string) {
-	gun := "docker.com/notary"
-
-	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-	defer os.RemoveAll(tempBaseDir)
-	origRootCert := certs[0]
-	replRootCert := certs[1]
-
-	// Add the old root cert part of trustedCertificates
-	keyStoreManager.AddTrustedCert(origRootCert)
-
-	// We need the PEM representation of the replacement key to put it into the TUF data
-	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
-	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-
-	// Tuf key with PEM-encoded x509 certificate
-	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
-	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-
-	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-	assert.NoError(t, err)
-
-	testRoot, err := data.NewRoot(
-		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-		map[string]*data.RootRole{"root": &rootRole.RootRole},
-		false,
-	)
-	assert.NoError(t, err, "Failed to create new root")
-
-	signedTestRoot, err := testRoot.ToSigned()
-	assert.NoError(t, err)
-
-	// We only sign with the old key, and not with the new one
-	err = signed.Sign(
-		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
-		signedTestRoot, origRootKey)
-	assert.NoError(t, err)
-
-	//
-	// This call to ValidateRoot will succeed since we are using a valid PEM
-	// encoded certificate, and have no other certificates for this CN
-	//
-	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-	assert.Error(t, err, "insuficient signatures on root")
-
-	// Finally, validate the only trusted certificate that exists is still
-	// the old one
-	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-	assert.Len(t, certs, 1)
-	assert.Equal(t, certs[0], origRootCert)
-}
+//import (
+//	"bytes"
+//	"crypto/x509"
+//	"encoding/json"
+//	"io/ioutil"
+//	"os"
+//	"path/filepath"
+//	"testing"
+//	"text/template"
+//
+//	"github.com/docker/notary/cryptoservice"
+//	"github.com/docker/notary/trustmanager"
+//	"github.com/docker/notary/tuf/data"
+//	"github.com/docker/notary/tuf/signed"
+//	"github.com/stretchr/testify/assert"
+//)
+//
+//type SignedRSARootTemplate struct {
+//	RootPem string
+//}
+//
+//var passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "passphrase", false, nil }
+//
+//const validPEMEncodedRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZLekNDQXhXZ0F3SUJBZ0lRUnlwOVFxY0pmZDNheXFkaml6OHhJREFMQmdrcWhraUc5dzBCQVFzd09ERWEKTUJnR0ExVUVDaE1SWkc5amEyVnlMbU52YlM5dWIzUmhjbmt4R2pBWUJnTlZCQU1URVdSdlkydGxjaTVqYjIwdgpibTkwWVhKNU1CNFhEVEUxTURjeE56QTJNelF5TTFvWERURTNNRGN4TmpBMk16UXlNMW93T0RFYU1CZ0dBMVVFCkNoTVJaRzlqYTJWeUxtTnZiUzl1YjNSaGNua3hHakFZQmdOVkJBTVRFV1J2WTJ0bGNpNWpiMjB2Ym05MFlYSjUKTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUFvUWZmcnpzWW5zSDh2R2Y0Smg1NQpDajV3cmpVR3pEL3NIa2FGSHB0ako2VG9KR0p2NXlNQVB4enlJbnU1c0lvR0xKYXBuWVZCb0FVMFlnSTlxbEFjCllBNlN4YVN3Z202cnB2bW5sOFFuMHFjNmdlcjNpbnBHYVVKeWxXSHVQd1drdmNpbVFBcUhaeDJkUXRMN2c2a3AKcm1LZVRXcFdvV0x3M0pvQVVaVVZoWk1kNmEyMlpML0R2QXcrSHJvZ2J6NFhleWFoRmI5SUg0MDJ6UHhONnZnYQpKRUZURjBKaTFqdE5nME1vNHBiOVNIc01zaXcrTFpLN1NmZkhWS1B4dmQyMW0vYmlObXdzZ0V4QTNVOE9PRzhwCnV5Z2ZhY3lzNWM4K1pyWCtaRkcvY3Z3S3owazYvUWZKVTQwczZNaFh3NUMyV3R0ZFZtc0c5LzdyR0ZZakhvSUoKd2VEeXhnV2s3dnhLelJKSS91bjdjYWdESWFRc0tySlFjQ0hJR0ZSbHBJUjVUd1g3dmwzUjdjUm5jckRSTVZ2YwpWU0VHMmVzeGJ3N2p0eklwL3lwblZSeGNPbnk3SXlweWpLcVZlcVo2SGd4WnRUQlZyRjFPL2FIbzJrdmx3eVJTCkF1czRrdmg2ejMranpUbTlFemZYaVBRelk5QkVrNWdPTHhoVzlyYzZVaGxTK3BlNWxrYU4vSHlxeS9sUHVxODkKZk1yMnJyN2xmNVdGZEZuemU2V05ZTUFhVzdkTkE0TkUwZHlENTM0MjhaTFh4TlZQTDRXVTY2R2FjNmx5blE4bApyNXRQc1lJRlh6aDZGVmFSS0dRVXRXMWh6OWVjTzZZMjdSaDJKc3lpSXhnVXFrMm9veEU2OXVONDJ0K2R0cUtDCjFzOEcvN1Z0WThHREFMRkxZVG56THZzQ0F3RUFBYU0xTURNd0RnWURWUjBQQVFIL0JBUURBZ0NnTUJNR0ExVWQKSlFRTU1Bb0dDQ3NHQVFVRkJ3TURNQXdHQTFVZEV3RUIvd1FDTUFBd0N3WUpLb1pJaHZjTkFRRUxBNElDQVFCTQpPbGwzRy9YQno4aWRpTmROSkRXVWgrNXczb2ptd2FuclRCZENkcUVrMVdlbmFSNkR0Y2ZsSng2WjNmL213VjRvCmIxc2tPQVgxeVg1UkNhaEpIVU14TWljei9RMzhwT1ZlbEdQclduYzNUSkIrVktqR3lIWGxRRFZrWkZiKzQrZWYKd3RqN0huZ1hoSEZGRFNnam0zRWRNbmR2Z0RRN1NRYjRza09uQ05TOWl5WDdlWHhoRkJDWm1aTCtIQUxLQmoyQgp5aFY0SWNCRHFtcDUwNHQxNHJ4OS9KdnR5MGRHN2ZZN0k1MWdFUXBtNFMwMkpNTDV4dlRtMXhmYm9XSWhaT0RJCnN3RUFPK2VrQm9GSGJTMVE5S01QaklBdzNUckNISDh4OFhacTV6c1l0QUMxeVpIZENLYTI2YVdkeTU2QTllSGoKTzFWeHp3bWJOeVhSZW5WdUJZUCswd3IzSFZLRkc0Sko0WlpwTlp6UVcvcHFFUGdoQ1RKSXZJdWVLNjUyQnlVYwovL3N2K25YZDVmMTlMZUVTOXBmMGwyNTNORGFGWlBiNmFlZ0tmcXVXaDhxbFFCbVVRMkd6YVRMYnRtTmQyOE02Clc3aUw3dGtLWmUxWm5CejlSS2d0UHJEampXR1pJbmpqY09VOEV0VDRTTHE3a0NWRG1QczVNRDh2YUFtOTZKc0UKam1MQzNVdS80azdIaURZWDBpMG1PV2tGalpRTWRWYXRjSUY1RlBTcHB3c1NiVzhRaWRuWHQ1NFV0d3RGREVQegpscGpzN3liZVFFNzFKWGNNWm5WSUs0YmpSWHNFRlBJOThScElsRWRlZGJTVWRZQW5jTE5KUlQ3SFpCTVBHU3daCjBQTkp1Z2xubHIzc3JWemRXMWR6MnhRamR2THd4eTZtTlVGNnJiUUJXQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K`
+//
+//const validCAPEMEncodeRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg==`
+//
+//const validIntermediateAndCertRSA = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQ0KTUlJRlZ6Q0NBeitnQXdJQkFnSUJBekFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUm93R0FZRFZRUUREQkZPYjNSaA0KY25rZ1ZHVnpkR2x1WnlCRFFURUxNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJseg0KWTI4eER6QU5CZ05WQkFvTUJrUnZZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdIaGNOTVRVd056RTJNRFF5TlRVdw0KV2hjTk1UWXdOekUxTURReU5UVXdXakJnTVJzd0dRWURWUVFEREJKelpXTjFjbVV1WlhoaGJYQnNaUzVqYjIweA0KQ3pBSkJnTlZCQVlUQWxWVE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRQ0KYjJOclpYSXhDekFKQmdOVkJBZ01Ba05CTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQw0KQVFFQW1MWWlZQ1RBV0pCV0F1eFpMcVZtVjRGaVVkR2dFcW9RdkNiTjczekYvbVFmaHEwQ0lUbzZ4U3hzMVFpRw0KRE96VXRrcHpYenppU2o0SjUrZXQ0SmtGbGVlRUthTWNIYWRlSXNTbEhHdlZ0WER2OTNvUjN5ZG1mWk8rVUxSVQ0KOHhIbG9xY0xyMUtyT1AxZGFMZmRNUmJhY3RkNzVVUWd2dzlYVHNkZU1WWDVBbGljU0VOVktWK0FRWHZWcHY4UA0KVDEwTVN2bEJGYW00cmVYdVkvU2tlTWJJYVc1cEZ1NkFRdjNabWZ0dDJ0YTBDQjlrYjFtWWQrT0tydThIbm5xNQ0KYUp3NlIzR2hQMFRCZDI1UDFQa2lTeE0yS0dZWlprMFcvTlpxTEs5L0xURktUTkN2N1ZqQ2J5c1ZvN0h4Q1kwYg0KUWUvYkRQODJ2N1NuTHRiM2Fab2dmdmE0SFFJREFRQUJvNElCR3pDQ0FSY3dnWWdHQTFVZEl3U0JnREIrZ0JSMw0KdVBJWEFYQUtkRzFGWlU4VjNrUU9LQk5lcWFGanBHRXdYekVMTUFrR0ExVUVCaE1DVlZNeEN6QUpCZ05WQkFnTQ0KQWtOQk1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRWIyTnJaWEl4R2pBWQ0KQmdOVkJBTU1FVTV2ZEdGeWVTQlVaWE4wYVc1bklFTkJnZ0VCTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwbA0KQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQTRHQTFVZER3RUIvd1FFQXdJRm9EQXVCZ05WSFJFRQ0KSnpBbGdoSnpaV04xY21VdVpYaGhiWEJzWlM1amIyMkNDV3h2WTJGc2FHOXpkSWNFZndBQUFUQWRCZ05WSFE0RQ0KRmdRVURQRDRDYVhSYnU1UUJiNWU4eThvZHZUcVc0SXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSk95bG1jNA0KbjdKNjRHS3NQL3hoVWRLS1Y5L0tEK3VmenBLYnJMSW9qV243clR5ZTcwdlkwT2pRRnVPWGM1NHlqTVNJTCsvNQ0KbWxOUTdZL2ZKUzh4ZEg3OUVSKzRuV011RDJlY2lMbnNMZ2JZVWs0aGl5Ynk4LzVWKy9ZcVBlQ3BQQ242VEpSSw0KYTBFNmxWL1VqWEpkcmlnSnZKb05PUjhaZ3RFWi9RUGdqSkVWVXNnNDdkdHF6c0RwZ2VTOGRjanVNV3BaeFAwMg0KcWF2RkxEalNGelZIKzJENk90eTFEUXBsbS8vM1hhUlhoMjNkT0NQOHdqL2J4dm5WVG9GV3Mrek80dVQxTEYvUw0KS1hDTlFvZWlHeFdIeXpyWEZWVnRWbkM5RlNOejBHZzIvRW0xdGZSZ3ZoVW40S0xKY3ZaVzlvMVI3VlZDWDBMMQ0KMHgwZnlLM1ZXZVdjODZhNWE2ODFhbUtaU0ViakFtSVZaRjl6T1gwUE9EQzhveSt6cU9QV2EwV0NsNEs2ekRDNg0KMklJRkJCTnk1MFpTMmlPTjZSWTZtRTdObUE3OGdja2Y0MTVjcUlWcmxvWUpiYlREZXBmaFRWMjE4U0xlcHBoNA0KdUdiMi9zeGtsZkhPWUUrcnBIY2lpYld3WHJ3bE9ESmFYdXpYRmhwbFVkL292ZHVqQk5BSUhrQmZ6eStZNnoycw0KYndaY2ZxRDROSWIvQUdoSXlXMnZidnU0enNsRHAxTUVzTG9hTytTemlyTXpreU1CbEtSdDEyMHR3czRFa1VsbQ0KL1FoalNVb1pwQ0FzeTVDL3BWNCtieDBTeXNOZC9TK2tLYVJaYy9VNlkzWllCRmhzekxoN0phTFhLbWs3d0huRQ0KcmdnbTZvejRML0d5UFdjL0ZqZm5zZWZXS00yeUMzUURoanZqDQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo=`
+//
+//const signedRSARootTemplate = `{"signed":{"_type":"Root","consistent_snapshot":false,"expires":"2016-07-16T23:34:13.389129622-07:00","keys":{"1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nIgzLigo5D47dWQe1IUjzHXxvyx0j/OL16VQymuloWsgVDxxT6+mH3CeviMAs+/McnEPE9exnm6SQGR5x3XMw=="}},"23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEClUFVWkc85OQScfTQRS02VaLIEaeCmxdwYS/hcTLVoTxlFfRfs7HyalTwXGAGO79XZZS+koE6s8D0xGcCJQkLQ=="}},"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292":{"keytype":"rsa-x509","keyval":{"private":null,"public":"{{.RootPem}}"}},"e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}},"roles":{"root":{"keyids":["49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292"],"threshold":1},"snapshot":{"keyids":["23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14"],"threshold":1},"targets":{"keyids":["1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670"],"threshold":1},"timestamp":{"keyids":["e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9"],"threshold":1}},"version":2},"signatures":[{"keyid":"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292","method":"rsapss","sig":"YlZwtCj028Xc23+KHfj6govFEY6hMbBXO5HT20F0I5ZeIPb1l7OmkjEiwp9ZHusClY+QeqiP1CFh\n/AfCbv4tLanqMkXPtm8UJJ1hMZVq86coieB32PQDj9k6x1hErHzvPUbOzTRW2BQkFFMZFkLDAd06\npH8lmxyPLOhdkVE8qIT7sBCy/4bQIGfvEX6yCDz84MZdcLNX5B9mzGi9A7gDloh9IEZxA8UgoI18\nSYpv/fYeSZSqM/ws2G+kiELGgTWhcZ+gOlF7ArM/DOlcC/NYqcvY1ugE6Gn7G8opre6NOofdRp3w\n603A2rMMvYTwqKLY6oX/d+07A2+WGHXPUy5otCAybWOw2hIZ35Jjmh12g6Dc6Qk4K2zXwAgvWwBU\nWlT8MlP1Tf7f80jnGjh0aARlHI4LCxlYU5L/pCaYuHgynujvLuzoOuiiPfJv7sYvKoQ8UieE1w//\nHc8E6tWtV5G2FguKLurMoKZ9FBWcanDO0fg5AWuG3qcgUJdvh9acQ33EKer1fqBxs6LSAUWo8rDt\nQkg+b55AW0YBukAW9IAfMySQGAS2e3mHZ8nK/ijaygCRu7/P+NgKY9/zpmfL2xgcNslLcANcSOOt\nhiJS6yqYM9i9G0af0yw/TxAT4ntwjVm8u52UyR/hXIiUc/mjZcYRbSmJOHws902+i+Z/qv72knk="}]}`
+//
+//func TestCertsToRemove(t *testing.T) {
+//	// Get a few certificates to test with
+//	cert1, err := trustmanager.LoadCertFromFile("../fixtures/secure.example.com.crt")
+//	assert.NoError(t, err)
+//	cert1KeyID, err := trustmanager.FingerprintCert(cert1)
+//	assert.NoError(t, err)
+//
+//	// Get intermediate certificate
+//	cert2, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_secure.example.com.crt")
+//	assert.NoError(t, err)
+//	cert2KeyID, err := trustmanager.FingerprintCert(cert2)
+//	assert.NoError(t, err)
+//
+//	// Get leaf certificate
+//	cert3, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_docker.com-notary.crt")
+//	assert.NoError(t, err)
+//	cert3KeyID, err := trustmanager.FingerprintCert(cert3)
+//	assert.NoError(t, err)
+//
+//	// Call CertsToRemove with only one old and one new
+//	oldCerts := []*x509.Certificate{cert1}
+//	newCerts := []*x509.Certificate{cert2}
+//
+//	certs := certsToRemove(oldCerts, newCerts)
+//	assert.Len(t, certs, 1)
+//	_, ok := certs[cert1KeyID]
+//	assert.True(t, ok)
+//
+//	// Call CertsToRemove with two old and one new
+//	oldCerts = []*x509.Certificate{cert1, cert2}
+//	newCerts = []*x509.Certificate{cert3}
+//
+//	certs = certsToRemove(oldCerts, newCerts)
+//	assert.Len(t, certs, 2)
+//	_, ok = certs[cert1KeyID]
+//	assert.True(t, ok)
+//	_, ok = certs[cert2KeyID]
+//	assert.True(t, ok)
+//	_, ok = certs[cert3KeyID]
+//	assert.False(t, ok)
+//
+//	// Call CertsToRemove with two new and one old
+//	oldCerts = []*x509.Certificate{cert3}
+//	newCerts = []*x509.Certificate{cert2, cert1}
+//
+//	certs = certsToRemove(oldCerts, newCerts)
+//	assert.Len(t, certs, 1)
+//	_, ok = certs[cert3KeyID]
+//	assert.True(t, ok)
+//	_, ok = certs[cert1KeyID]
+//	assert.False(t, ok)
+//	_, ok = certs[cert2KeyID]
+//	assert.False(t, ok)
+//
+//	// Call CertsToRemove with three old certs and no new
+//	oldCerts = []*x509.Certificate{cert1, cert2, cert3}
+//	newCerts = []*x509.Certificate{}
+//
+//	certs = certsToRemove(oldCerts, newCerts)
+//	assert.Len(t, certs, 0)
+//	_, ok = certs[cert1KeyID]
+//	assert.False(t, ok)
+//	_, ok = certs[cert2KeyID]
+//	assert.False(t, ok)
+//	_, ok = certs[cert3KeyID]
+//	assert.False(t, ok)
+//
+//	// Call CertsToRemove with three new certs and no old
+//	oldCerts = []*x509.Certificate{}
+//	newCerts = []*x509.Certificate{cert1, cert2, cert3}
+//
+//	certs = certsToRemove(oldCerts, newCerts)
+//	assert.Len(t, certs, 0)
+//	_, ok = certs[cert1KeyID]
+//	assert.False(t, ok)
+//	_, ok = certs[cert2KeyID]
+//	assert.False(t, ok)
+//	_, ok = certs[cert3KeyID]
+//	assert.False(t, ok)
+//
+//}
+//
+//func TestValidateRoot(t *testing.T) {
+//	var testSignedRoot data.Signed
+//	var signedRootBytes bytes.Buffer
+//
+//	// Temporary directory where test files will be created
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	defer os.RemoveAll(tempBaseDir)
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	keysPath := filepath.Join(tempBaseDir, PrivDir)
+//	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+//	assert.NoError(t, err)
+//
+//	// Create a FileStoreManager
+//	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
+//	assert.NoError(t, err)
+//
+//	// Execute our template
+//	templ, _ := template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validPEMEncodedRSARoot})
+//
+//	// Unmarshal our signedroot
+//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+//
+//	//
+//	// This call to ValidateRoot will succeed since we are using a valid PEM
+//	// encoded certificate, and have no other certificates for this CN
+//	//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+//	assert.NoError(t, err)
+//
+//	//
+//	// This call to ValidateRoot will fail since we are passing in a dnsName that
+//	// doesn't match the CN of the certificate.
+//	//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "diogomonica.com/notary")
+//	if assert.Error(t, err, "An error was expected") {
+//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+//	}
+//
+//	//
+//	// This call to ValidateRoot will fail since we are passing an unparsable RootSigned
+//	//
+//	// Execute our template deleting the old buffer first
+//	signedRootBytes.Reset()
+//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "------ ABSOLUTELY NOT A PEM -------"})
+//	// Unmarshal our signedroot
+//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+//	assert.Error(t, err, "illegal base64 data at input byte")
+//
+//	//
+//	// This call to ValidateRoot will fail since we are passing an invalid PEM cert
+//	//
+//	// Execute our template deleting the old buffer first
+//	signedRootBytes.Reset()
+//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "LS0tLS1CRUdJTiBDRVJU"})
+//	// Unmarshal our signedroot
+//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+//	if assert.Error(t, err, "An error was expected") {
+//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+//	}
+//
+//	//
+//	// This call to ValidateRoot will fail since we are passing only CA certificate
+//	// This will fail due to the lack of a leaf certificate
+//	//
+//	// Execute our template deleting the old buffer first
+//	signedRootBytes.Reset()
+//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validCAPEMEncodeRSARoot})
+//	// Unmarshal our signedroot
+//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+//	if assert.Error(t, err, "An error was expected") {
+//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+//	}
+//
+//	//
+//	// This call to ValidateRoot will suceed in getting to the TUF validation, since
+//	// we are using a valid PEM encoded certificate chain of intermediate + leaf cert
+//	// that are signed by a trusted root authority and the leaf cert has a correct CN.
+//	// It will, however, fail to validate, because it has an invalid TUF signature
+//	//
+//	// Execute our template deleting the old buffer first
+//	signedRootBytes.Reset()
+//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validIntermediateAndCertRSA})
+//
+//	// Unmarshal our signedroot
+//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+//
+//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "secure.example.com")
+//	if assert.Error(t, err, "An error was expected") {
+//		assert.Equal(t, err, &ErrValidationFail{Reason: "failed to validate integrity of roots"})
+//	}
+//}
+//
+//// TestValidateSuccessfulRootRotation runs through a full root certificate rotation
+//// We test this with both an RSA and ECDSA root certificate
+//func TestValidateSuccessfulRootRotation(t *testing.T) {
+//	testValidateSuccessfulRootRotation(t, data.ECDSAKey, data.ECDSAx509Key)
+//	if !testing.Short() {
+//		testValidateSuccessfulRootRotation(t, data.RSAKey, data.RSAx509Key)
+//	}
+//}
+//
+//// Generates a KeyStoreManager in a temporary directory and returns the
+//// manager and certificates for two keys which have been added to the keystore.
+//// Also returns the temporary directory so it can be cleaned up.
+//func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
+//	string, *KeyStoreManager, []*x509.Certificate) {
+//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+//
+//	keysPath := filepath.Join(tempBaseDir, PrivDir)
+//	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+//	assert.NoError(t, err)
+//
+//	// Create a FileStoreManager
+//	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
+//	assert.NoError(t, err)
+//
+//	certs := make([]*x509.Certificate, 2)
+//	for i := 0; i < 2; i++ {
+//		keyID, err := keyStoreManager.GenRootKey(keyAlg)
+//		assert.NoError(t, err)
+//
+//		key, _, err := keyStoreManager.KeyStore.GetKey(keyID)
+//		assert.NoError(t, err)
+//
+//		cert, err := cryptoservice.GenerateCertificate(key, gun)
+//		assert.NoError(t, err)
+//
+//		certs[i] = cert
+//	}
+//	return tempBaseDir, keyStoreManager, certs
+//}
+//
+//func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string) {
+//	// The gun to test
+//	gun := "docker.com/notary"
+//
+//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+//	defer os.RemoveAll(tempBaseDir)
+//	origRootCert := certs[0]
+//	replRootCert := certs[1]
+//
+//	// Add the old root cert part of trustedCertificates
+//	keyStoreManager.AddTrustedCert(origRootCert)
+//
+//	// We need the PEM representation of the replacement key to put it into the TUF data
+//	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
+//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+//
+//	// Tuf key with PEM-encoded x509 certificate
+//	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
+//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+//
+//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+//	assert.NoError(t, err)
+//
+//	testRoot, err := data.NewRoot(
+//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+//		map[string]*data.RootRole{"root": &rootRole.RootRole},
+//		false,
+//	)
+//	assert.NoError(t, err, "Failed to create new root")
+//
+//	signedTestRoot, err := testRoot.ToSigned()
+//	assert.NoError(t, err)
+//
+//	cs := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
+//
+//	err = signed.Sign(cs, signedTestRoot, replRootKey)
+//	assert.NoError(t, err)
+//
+//	err = signed.Sign(cs, signedTestRoot, origRootKey)
+//	assert.NoError(t, err)
+//
+//	//
+//	// This call to ValidateRoot will succeed since we are using a valid PEM
+//	// encoded certificate, and have no other certificates for this CN
+//	//
+//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+//	assert.NoError(t, err)
+//
+//	// Finally, validate the only trusted certificate that exists is the new one
+//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+//	assert.Len(t, certs, 1)
+//	assert.Equal(t, certs[0], replRootCert)
+//}
+//
+//// TestValidateRootRotationMissingOrigSig runs through a full root certificate rotation
+//// where we are missing the original root key signature. Verification should fail.
+//// We test this with both an RSA and ECDSA root certificate
+//func TestValidateRootRotationMissingOrigSig(t *testing.T) {
+//	testValidateRootRotationMissingOrigSig(t, data.ECDSAKey, data.ECDSAx509Key)
+//	if !testing.Short() {
+//		testValidateRootRotationMissingOrigSig(t, data.RSAKey, data.RSAx509Key)
+//	}
+//}
+//
+//func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType string) {
+//	gun := "docker.com/notary"
+//
+//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+//	defer os.RemoveAll(tempBaseDir)
+//	origRootCert := certs[0]
+//	replRootCert := certs[1]
+//
+//	// Add the old root cert part of trustedCertificates
+//	keyStoreManager.AddTrustedCert(origRootCert)
+//
+//	// We need the PEM representation of the replacement key to put it into the TUF data
+//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+//
+//	// Tuf key with PEM-encoded x509 certificate
+//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+//
+//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+//	assert.NoError(t, err)
+//
+//	testRoot, err := data.NewRoot(
+//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+//		map[string]*data.RootRole{"root": &rootRole.RootRole},
+//		false,
+//	)
+//	assert.NoError(t, err, "Failed to create new root")
+//
+//	signedTestRoot, err := testRoot.ToSigned()
+//	assert.NoError(t, err)
+//
+//	// We only sign with the new key, and not with the original one.
+//	err = signed.Sign(
+//		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
+//		signedTestRoot, replRootKey)
+//	assert.NoError(t, err)
+//
+//	//
+//	// This call to ValidateRoot will succeed since we are using a valid PEM
+//	// encoded certificate, and have no other certificates for this CN
+//	//
+//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+//	assert.Error(t, err, "insuficient signatures on root")
+//
+//	// Finally, validate the only trusted certificate that exists is still
+//	// the old one
+//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+//	assert.Len(t, certs, 1)
+//	assert.Equal(t, certs[0], origRootCert)
+//}
+//
+//// TestValidateRootRotationMissingNewSig runs through a full root certificate rotation
+//// where we are missing the new root key signature. Verification should fail.
+//// We test this with both an RSA and ECDSA root certificate
+//func TestValidateRootRotationMissingNewSig(t *testing.T) {
+//	testValidateRootRotationMissingNewSig(t, data.ECDSAKey, data.ECDSAx509Key)
+//	if !testing.Short() {
+//		testValidateRootRotationMissingNewSig(t, data.RSAKey, data.RSAx509Key)
+//	}
+//}
+//
+//func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType string) {
+//	gun := "docker.com/notary"
+//
+//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+//	defer os.RemoveAll(tempBaseDir)
+//	origRootCert := certs[0]
+//	replRootCert := certs[1]
+//
+//	// Add the old root cert part of trustedCertificates
+//	keyStoreManager.AddTrustedCert(origRootCert)
+//
+//	// We need the PEM representation of the replacement key to put it into the TUF data
+//	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
+//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+//
+//	// Tuf key with PEM-encoded x509 certificate
+//	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
+//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+//
+//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+//	assert.NoError(t, err)
+//
+//	testRoot, err := data.NewRoot(
+//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+//		map[string]*data.RootRole{"root": &rootRole.RootRole},
+//		false,
+//	)
+//	assert.NoError(t, err, "Failed to create new root")
+//
+//	signedTestRoot, err := testRoot.ToSigned()
+//	assert.NoError(t, err)
+//
+//	// We only sign with the old key, and not with the new one
+//	err = signed.Sign(
+//		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
+//		signedTestRoot, origRootKey)
+//	assert.NoError(t, err)
+//
+//	//
+//	// This call to ValidateRoot will succeed since we are using a valid PEM
+//	// encoded certificate, and have no other certificates for this CN
+//	//
+//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+//	assert.Error(t, err, "insuficient signatures on root")
+//
+//	// Finally, validate the only trusted certificate that exists is still
+//	// the old one
+//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+//	assert.Len(t, certs, 1)
+//	assert.Equal(t, certs[0], origRootCert)
+//}
diff --git a/pkg/passphrase/passphrase.go b/passphrase/passphrase.go
similarity index 96%
rename from pkg/passphrase/passphrase.go
rename to passphrase/passphrase.go
index b00368fa8e..6381b2af09 100644
--- a/pkg/passphrase/passphrase.go
+++ b/passphrase/passphrase.go
@@ -113,22 +113,23 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 			indexOfLastSeparator = 0
 		}
 
+		var shortName string
 		if len(keyName) > indexOfLastSeparator+idBytesToDisplay {
 			if indexOfLastSeparator > 0 {
 				keyNamePrefix := keyName[:indexOfLastSeparator]
 				keyNameID := keyName[indexOfLastSeparator+1 : indexOfLastSeparator+idBytesToDisplay+1]
-				keyName = keyNamePrefix + " (" + keyNameID + ")"
+				shortName = keyNamePrefix + " (" + keyNameID + ")"
 			} else {
-				keyName = keyName[indexOfLastSeparator : indexOfLastSeparator+idBytesToDisplay]
+				shortName = keyName[indexOfLastSeparator : indexOfLastSeparator+idBytesToDisplay]
 			}
 		}
 
 		if createNew {
-			fmt.Fprintf(out, "Enter passphrase for new %s key with id %s: ", displayAlias, keyName)
+			fmt.Fprintf(out, "Enter passphrase for new %s key with id %s: ", displayAlias, shortName)
 		} else if displayAlias == "yubikey" {
 			fmt.Fprintf(out, "Enter the %s for the attached Yubikey: ", keyName)
 		} else {
-			fmt.Fprintf(out, "Enter passphrase for %s key with id %s: ", displayAlias, keyName)
+			fmt.Fprintf(out, "Enter passphrase for %s key with id %s: ", displayAlias, shortName)
 		}
 
 		passphrase, err := stdin.ReadBytes('\n')
diff --git a/signer/api/api_test.go b/signer/api/api_test.go
index 729a3aaee7..17c598f6a7 100644
--- a/signer/api/api_test.go
+++ b/signer/api/api_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
+	"github.com/docker/notary/tuf/signed"
 	"github.com/stretchr/testify/assert"
 
 	pb "github.com/docker/notary/proto"
@@ -131,7 +132,7 @@ func TestHSMCreateKeyHandler(t *testing.T) {
 	defer ctx.CloseSession(session)
 	defer ctx.Logout(session)
 
-	cryptoService := api.NewRSAHardwareCryptoService(ctx, session)
+	cryptoService := signed.NewEd25519()
 	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
 
 	createKeyURL := fmt.Sprintf("%s/%s", createKeyBaseURL, data.RSAKey)
@@ -182,7 +183,7 @@ func TestHSMSignHandler(t *testing.T) {
 	defer ctx.CloseSession(session)
 	defer ctx.Logout(session)
 
-	cryptoService := api.NewRSAHardwareCryptoService(ctx, session)
+	cryptoService := signed.NewEd25519()
 	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
 
 	tufKey, _ := cryptoService.Create("", data.RSAKey)
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 8da450e7d6..443c3563cc 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -15,7 +15,7 @@ import (
 	"math/big"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/miekg/pkcs11"
diff --git a/signer/api/rpc_api_test.go b/signer/api/rpc_api_test.go
index c3c20152e9..2650cce806 100644
--- a/signer/api/rpc_api_test.go
+++ b/signer/api/rpc_api_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
diff --git a/signer/api/rsa_hardware_crypto_service.go b/signer/api/rsa_hardware_crypto_service.go
deleted file mode 100644
index 640f2891d4..0000000000
--- a/signer/api/rsa_hardware_crypto_service.go
+++ /dev/null
@@ -1,212 +0,0 @@
-// +build pkcs11
-
-package api
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/sha256"
-	"crypto/x509"
-	"errors"
-	"log"
-	"math/big"
-
-	"github.com/docker/notary/signer/keys"
-	"github.com/docker/notary/tuf/data"
-	"github.com/miekg/pkcs11"
-)
-
-// RSAHardwareCryptoService is an implementation of SigningService
-type RSAHardwareCryptoService struct {
-	keys    map[string]*keys.HSMRSAKey
-	context *pkcs11.Ctx
-	session pkcs11.SessionHandle
-}
-
-// ListKeys not implemented yet
-func (s *RSAHardwareCryptoService) ListKeys(role string) []string {
-	return []string{}
-}
-
-// Create creates a key and returns its public components
-func (s *RSAHardwareCryptoService) Create(role, algo string) (data.PublicKey, error) {
-	// For now generate random labels for keys
-	// (diogo): add link between keyID and label in database so we can support multiple keys
-	randomLabel := make([]byte, 32)
-	_, err := rand.Read(randomLabel)
-	if err != nil {
-		return nil, errors.New("Could not generate a random key label.")
-	}
-
-	// Set the public key template
-	// CKA_TOKEN: Guarantees key persistence in hardware
-	// CKA_LABEL: Identifies this specific key inside of the HSM
-	publicKeyTemplate := []*pkcs11.Attribute{
-		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
-		pkcs11.NewAttribute(pkcs11.CKA_PUBLIC_EXPONENT, []byte{3}),
-		pkcs11.NewAttribute(pkcs11.CKA_MODULUS_BITS, 2048),
-		pkcs11.NewAttribute(pkcs11.CKA_LABEL, string(randomLabel)),
-	}
-	privateKeyTemplate := []*pkcs11.Attribute{
-		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
-		pkcs11.NewAttribute(pkcs11.CKA_PRIVATE, true),
-		pkcs11.NewAttribute(pkcs11.CKA_SIGN, true),
-		pkcs11.NewAttribute(pkcs11.CKA_LABEL, string(randomLabel)),
-	}
-
-	// Generate a new RSA private/public keypair inside of the HSM
-	pub, priv, err := s.context.GenerateKeyPair(s.session,
-		[]*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_KEY_PAIR_GEN, nil)},
-		publicKeyTemplate, privateKeyTemplate)
-	if err != nil {
-		return nil, errors.New("Could not generate a new key inside of the HSM.")
-	}
-
-	// (diogo): This template is used for the GetAttribute
-	template := []*pkcs11.Attribute{
-		pkcs11.NewAttribute(pkcs11.CKA_PUBLIC_EXPONENT, nil),
-		pkcs11.NewAttribute(pkcs11.CKA_MODULUS_BITS, nil),
-		pkcs11.NewAttribute(pkcs11.CKA_MODULUS, nil),
-	}
-
-	// Retrieve the public-key material to be able to create a new HSMRSAKey
-	attr, err := s.context.GetAttributeValue(s.session, pub, template)
-	if err != nil {
-		return nil, errors.New("Failed to get Attribute value.")
-	}
-
-	// We're going to store the elements of the RSA Public key, exponent and Modulus inside of exp and mod
-	var exp int
-	mod := big.NewInt(0)
-
-	// Iterate through all the attributes of this key and saves CKA_PUBLIC_EXPONENT and CKA_MODULUS. Removes ordering specific issues.
-	for _, a := range attr {
-		if a.Type == pkcs11.CKA_PUBLIC_EXPONENT {
-			exp, _ = readInt(a.Value)
-		}
-
-		if a.Type == pkcs11.CKA_MODULUS {
-			mod.SetBytes(a.Value)
-		}
-	}
-
-	rsaPublicKey := rsa.PublicKey{N: mod, E: exp}
-	// Using x509 to Marshal the Public key into der encoding
-	pubBytes, err := x509.MarshalPKIXPublicKey(&rsaPublicKey)
-	if err != nil {
-		return nil, errors.New("Failed to Marshal public key.")
-	}
-
-	// (diogo): Ideally I would like to return base64 PEM encoded public keys to the client
-	k := keys.NewHSMRSAKey(pubBytes, priv)
-
-	keyID := k.ID()
-
-	s.keys[keyID] = k
-
-	return k, nil
-}
-
-// RemoveKey removes a key from the key database
-func (s *RSAHardwareCryptoService) RemoveKey(keyID string) error {
-	if _, ok := s.keys[keyID]; !ok {
-		return keys.ErrInvalidKeyID
-	}
-
-	delete(s.keys, keyID)
-	return nil
-}
-
-// GetKey returns the public components of a particular key
-func (s *RSAHardwareCryptoService) GetKey(keyID string) data.PublicKey {
-	key, ok := s.keys[keyID]
-	if !ok {
-		return nil
-	}
-	return key
-}
-
-// GetPrivateKey is not implemented
-func (s *RSAHardwareCryptoService) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
-	return nil, "", errors.New("Not yet implemented")
-}
-
-// Sign returns a signature for a given signature request
-func (s *RSAHardwareCryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
-	signatures := make([]data.Signature, 0, len(keyIDs))
-	for _, keyid := range keyIDs {
-		privateKey, present := s.keys[keyid]
-		if !present {
-			// We skip keys that aren't found
-			continue
-		}
-
-		priv := privateKey.PKCS11ObjectHandle()
-		var sig []byte
-		var err error
-		for i := 0; i < 3; i++ {
-			s.context.SignInit(s.session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA256_RSA_PKCS, nil)}, priv)
-
-			sig, err = s.context.Sign(s.session, payload)
-			if err != nil {
-				log.Printf("Error while signing: %s", err)
-				continue
-			}
-
-			digest := sha256.Sum256(payload)
-			pub, err := x509.ParsePKIXPublicKey(privateKey.Public())
-			if err != nil {
-				log.Printf("Failed to parse public key: %s\n", err)
-				return nil, err
-			}
-
-			rsaPub, ok := pub.(*rsa.PublicKey)
-			if !ok {
-				log.Printf("Value returned from ParsePKIXPublicKey was not an RSA public key")
-				return nil, err
-			}
-
-			err = rsa.VerifyPKCS1v15(rsaPub, crypto.SHA256, digest[:], sig)
-			if err != nil {
-				log.Printf("Failed verification. Retrying: %s", err)
-				continue
-			}
-			break
-		}
-
-		if sig == nil {
-			return nil, errors.New("Failed to create signature")
-		}
-
-		signatures = append(signatures, data.Signature{
-			KeyID:     keyid,
-			Method:    data.RSAPKCS1v15Signature,
-			Signature: sig[:],
-		})
-	}
-
-	return signatures, nil
-}
-
-// NewRSAHardwareCryptoService returns an instance of RSAHardwareCryptoService
-func NewRSAHardwareCryptoService(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) *RSAHardwareCryptoService {
-	return &RSAHardwareCryptoService{
-		keys:    make(map[string]*keys.HSMRSAKey),
-		context: ctx,
-		session: session,
-	}
-}
-
-// readInt converts a []byte into an int. It is used to convert the RSA Public key exponent into an int to create a crypto.PublicKey
-func readInt(data []byte) (int, error) {
-	var ret int
-	if len(data) > 4 {
-		return 0, errors.New("Cannot convert byte array due to size")
-	}
-
-	for i, a := range data {
-		ret |= (int(a) << uint(i*8))
-	}
-	return ret, nil
-}
diff --git a/signer/keydbstore/keydbstore.go b/signer/keydbstore/keydbstore.go
index f99d3e31c3..c3e89a190c 100644
--- a/signer/keydbstore/keydbstore.go
+++ b/signer/keydbstore/keydbstore.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	jose "github.com/dvsekhvalnov/jose2go"
diff --git a/signer/signer_trust.go b/signer/signer_trust.go
index e8a3963888..200eb5f583 100644
--- a/signer/signer_trust.go
+++ b/signer/signer_trust.go
@@ -105,6 +105,11 @@ func (trust *NotarySigner) ListKeys(role string) []string {
 	return []string{}
 }
 
+// ListAllKeys not supported for NotarySigner
+func (trust *NotarySigner) ListAllKeys() map[string]string {
+	return map[string]string{}
+}
+
 // CheckHealth checks the health of one of the clients, since both clients run
 // from the same GRPC server.
 func (trust *NotarySigner) CheckHealth(timeout time.Duration) error {
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index af938b6eb9..aa3db3743b 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/tuf/data"
 )
 
diff --git a/trustmanager/keyfilestore_test.go b/trustmanager/keyfilestore_test.go
index c499bb56ca..fa418bf5a6 100644
--- a/trustmanager/keyfilestore_test.go
+++ b/trustmanager/keyfilestore_test.go
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/docker/notary/pkg/passphrase"
+	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index fa16430193..1b9536b163 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -8,22 +8,30 @@ import (
 	"github.com/docker/notary/tuf/data"
 )
 
+type edCryptoKey struct {
+	role    string
+	privKey data.PrivateKey
+}
+
 // Ed25519 implements a simple in memory cryptosystem for ED25519 keys
 type Ed25519 struct {
-	keys map[string]data.PrivateKey
+	keys map[string]edCryptoKey
 }
 
 // NewEd25519 initializes a new empty Ed25519 CryptoService that operates
 // entirely in memory
 func NewEd25519() *Ed25519 {
 	return &Ed25519{
-		make(map[string]data.PrivateKey),
+		make(map[string]edCryptoKey),
 	}
 }
 
 // addKey allows you to add a private key
-func (e *Ed25519) addKey(k data.PrivateKey) {
-	e.keys[k.ID()] = k
+func (e *Ed25519) addKey(role string, k data.PrivateKey) {
+	e.keys[k.ID()] = edCryptoKey{
+		role:    role,
+		privKey: k,
+	}
 }
 
 // RemoveKey deletes a key from the signer
@@ -41,12 +49,21 @@ func (e *Ed25519) ListKeys(role string) []string {
 	return keyIDs
 }
 
+// ListKeys returns the list of keys IDs for the role
+func (e *Ed25519) ListAllKeys() map[string]string {
+	keys := make(map[string]string)
+	for id, edKey := range e.keys {
+		keys[id] = edKey.role
+	}
+	return keys
+}
+
 // Sign generates an Ed25519 signature over the data
 func (e *Ed25519) Sign(keyIDs []string, toSign []byte) ([]data.Signature, error) {
 	signatures := make([]data.Signature, 0, len(keyIDs))
 	for _, keyID := range keyIDs {
 		priv := [ed25519.PrivateKeySize]byte{}
-		copy(priv[:], e.keys[keyID].Private())
+		copy(priv[:], e.keys[keyID].privKey.Private())
 		sig := ed25519.Sign(&priv, toSign)
 		signatures = append(signatures, data.Signature{
 			KeyID:     keyID,
@@ -74,7 +91,7 @@ func (e *Ed25519) Create(role, algorithm string) (data.PublicKey, error) {
 		return nil, err
 	}
 
-	e.addKey(private)
+	e.addKey(role, private)
 	return public, nil
 }
 
@@ -83,8 +100,8 @@ func (e *Ed25519) Create(role, algorithm string) (data.PublicKey, error) {
 func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error) {
 	k := make(map[string]data.PublicKey)
 	for _, keyID := range keyIDs {
-		if key, ok := e.keys[keyID]; ok {
-			k[keyID] = data.PublicKeyFromPrivate(key)
+		if edKey, ok := e.keys[keyID]; ok {
+			k[keyID] = data.PublicKeyFromPrivate(edKey.privKey)
 		}
 	}
 	return k, nil
@@ -92,10 +109,10 @@ func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error
 
 // GetKey returns a single public key based on the ID
 func (e *Ed25519) GetKey(keyID string) data.PublicKey {
-	return data.PublicKeyFromPrivate(e.keys[keyID])
+	return data.PublicKeyFromPrivate(e.keys[keyID].privKey)
 }
 
 // GetPrivateKey returns a single private key based on the ID
 func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
-	return e.keys[keyID], "", nil
+	return e.keys[keyID].privKey, "", nil
 }
diff --git a/tuf/signed/interface.go b/tuf/signed/interface.go
index fc72adbe6f..e9db58c492 100644
--- a/tuf/signed/interface.go
+++ b/tuf/signed/interface.go
@@ -32,8 +32,11 @@ type KeyService interface {
 	// RemoveKey deletes the specified key
 	RemoveKey(keyID string) error
 
-	// ListKeys returns a map of IDs to role
+	// ListKeys returns a list of key IDs for the role
 	ListKeys(role string) []string
+
+	// ListAllKeys returns a map of all available signing key IDs to role
+	ListAllKeys() map[string]string
 }
 
 // CryptoService defines a unified Signing and Key Service as this
diff --git a/tuf/signed/sign_test.go b/tuf/signed/sign_test.go
index 7a62c0abda..f7228b5acf 100644
--- a/tuf/signed/sign_test.go
+++ b/tuf/signed/sign_test.go
@@ -38,6 +38,15 @@ func (mts *FailingCryptoService) ListKeys(role string) []string {
 	return []string{mts.testKey.ID()}
 }
 
+func (mts *FailingCryptoService) ListAllKeys() map[string]string {
+	return map[string]string{
+		mts.testKey.ID(): "root",
+		mts.testKey.ID(): "targets",
+		mts.testKey.ID(): "snapshot",
+		mts.testKey.ID(): "timestamp",
+	}
+}
+
 func (mts *FailingCryptoService) GetKey(keyID string) data.PublicKey {
 	if keyID == "testID" {
 		return mts.testKey
@@ -80,6 +89,15 @@ func (mts *MockCryptoService) ListKeys(role string) []string {
 	return []string{mts.testKey.ID()}
 }
 
+func (mts *MockCryptoService) ListAllKeys() map[string]string {
+	return map[string]string{
+		mts.testKey.ID(): "root",
+		mts.testKey.ID(): "targets",
+		mts.testKey.ID(): "snapshot",
+		mts.testKey.ID(): "timestamp",
+	}
+}
+
 func (mts *MockCryptoService) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
 	return nil, "", errors.New("Not implemented")
 }
@@ -115,6 +133,15 @@ func (mts *StrictMockCryptoService) ListKeys(role string) []string {
 	return []string{mts.testKey.ID()}
 }
 
+func (mts *StrictMockCryptoService) ListAllKeys() map[string]string {
+	return map[string]string{
+		mts.testKey.ID(): "root",
+		mts.testKey.ID(): "targets",
+		mts.testKey.ID(): "snapshot",
+		mts.testKey.ID(): "timestamp",
+	}
+}
+
 // Test signing and ensure the expected signature is added
 func TestBasicSign(t *testing.T) {
 	testKey, _ := pem.Decode([]byte(testKeyPEM1))

From 6ba733579313238fa640adee7080bac0f8a5c9ef Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 4 Nov 2015 15:37:02 -0800
Subject: [PATCH 20/85] fill in implementation of removeKey for yubikey
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 50 +++++++++++++++++++--
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 443c3563cc..b3fae3b3ba 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -255,6 +255,47 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	return sig[:], nil
 }
 
+func removeKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
+	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN)
+	if err != nil {
+		return err
+	}
+	defer ctx.Logout(session)
+
+	template := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
+		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+		//pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE),
+	}
+
+	if err := ctx.FindObjectsInit(session, template); err != nil {
+		logrus.Printf("Failed to init: %s\n", err.Error())
+		return err
+	}
+	obj, b, err := ctx.FindObjects(session, 1)
+	if err != nil {
+		logrus.Printf("Failed to find: %s %v\n", err.Error(), b)
+		return err
+	}
+	if err := ctx.FindObjectsFinal(session); err != nil {
+		logrus.Printf("Failed to finalize: %s\n", err.Error())
+		return err
+	}
+	if len(obj) != 1 {
+		logrus.Printf("should have found one object")
+		return err
+	}
+
+	// Delete the certificate
+	err = ctx.DestroyObject(session, obj[0])
+	if err != nil {
+		logrus.Printf("Failed to delete cert")
+		return err
+	}
+	return nil
+}
+
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 }
@@ -316,9 +357,12 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 }
 
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
-	// TODO(diogo): actually implement this
-	logrus.Debugf("Attempting to remove: %s key inside of YubiKeyStore", keyID)
-	return nil
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return nil
+	}
+	defer cleanup(ctx, session)
+	return removeKey(ctx, session, YUBIKEY_ROOT_KEY_ID, s.passRetriever, keyID)
 }
 
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {

From da18f546992bb37071b9bb7ae563a5edceb9f0e5 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Thu, 5 Nov 2015 11:01:31 -0800
Subject: [PATCH 21/85] import-root, list, and remove working with yubikey
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go                          | 10 +++++++---
 signer/api/ecdsa_hardware_crypto_service.go | 10 ++++++----
 trustmanager/keyfilestore.go                |  6 +++---
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index f239c6ebbc..b6e0d226fa 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -12,6 +12,7 @@ import (
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 
 	"github.com/docker/notary/tuf/data"
@@ -119,7 +120,8 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	yubiStore := api.NewYubiKeyStore(retriever)
+	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
 
 	keyID := args[0]
 
@@ -160,7 +162,8 @@ func keysList(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	yubiStore := api.NewYubiKeyStore(retriever)
+	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
 
 	// Get a map of all the keys/roles
 	keysMap := cs.ListAllKeys()
@@ -354,7 +357,8 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	yubiStore := api.NewYubiKeyStore(retriever)
+	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index b3fae3b3ba..de730b5073 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -366,15 +366,17 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 }
 
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
-	// TODO(diogo): actually implement this
 	logrus.Debugf("Attempting to export: %s key inside of YubiKeyStore", keyID)
-	return nil, nil
+	return nil, errors.New("Keys cannot be exported from a Yubikey.")
 }
 
 func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
-	// TODO(diogo): actually implement this
 	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyID)
-	return nil
+	privKey, _, err := trustmanager.GetPasswdDecryptBytes(s.passRetriever, pemBytes, "imported", "root")
+	if err != nil {
+		return err
+	}
+	return s.AddKey(privKey.ID(), "root", privKey)
 }
 
 func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index aa3db3743b..ecc9af9709 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -197,7 +197,7 @@ func getKey(s LimitedFileStore, passphraseRetriever passphrase.Retriever, cached
 	// See if the key is encrypted. If its encrypted we'll fail to parse the private key
 	privKey, err := ParsePEMPrivateKey(keyBytes, "")
 	if err != nil {
-		privKey, _, retErr = getPasswdDecryptBytes(s, passphraseRetriever, keyBytes, name, string(keyAlias))
+		privKey, _, retErr = GetPasswdDecryptBytes(passphraseRetriever, keyBytes, name, string(keyAlias))
 	}
 	if retErr != nil {
 		return nil, "", retErr
@@ -270,7 +270,7 @@ func getRawKey(s LimitedFileStore, name string) ([]byte, string, error) {
 
 // Get the password to decript the given pem bytes.  Return the password,
 // because it is useful for importing
-func getPasswdDecryptBytes(s LimitedFileStore, passphraseRetriever passphrase.Retriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
+func GetPasswdDecryptBytes(passphraseRetriever passphrase.Retriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
 	var (
 		passwd  string
 		retErr  error
@@ -329,7 +329,7 @@ func encryptAndAddKey(s LimitedFileStore, passwd string, cachedKeys map[string]*
 
 func importKey(s LimitedFileStore, passphraseRetriever passphrase.Retriever, cachedKeys map[string]*cachedKey, alias string, pemBytes []byte) error {
 
-	privKey, passphrase, err := getPasswdDecryptBytes(s, passphraseRetriever, pemBytes, "imported", alias)
+	privKey, passphrase, err := GetPasswdDecryptBytes(passphraseRetriever, pemBytes, "imported", alias)
 
 	if err != nil {
 		return err

From fea898bd349e851473e7ce392b7198edfe46805b Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Thu, 5 Nov 2015 12:20:24 -0800
Subject: [PATCH 22/85] listing all keys in the yubikey works Signed-off-by:
 David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 125 +++++++++++++++++++-
 1 file changed, 120 insertions(+), 5 deletions(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index de730b5073..9cf1d66035 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -24,11 +24,17 @@ import (
 const (
 	USER_PIN    = "123456"
 	SO_USER_PIN = "010203040506070801020304050607080102030405060708"
+	numSlots    = 50 // number of slots in the yubikey
 )
 
 // Hardcoded yubikey PKCS11 ID
 var YUBIKEY_ROOT_KEY_ID = []byte{2}
 
+type yubiSlot struct {
+	role   string
+	slotID []byte
+}
+
 // YubiPrivateKey represents a private key inside of a yubikey
 type YubiPrivateKey struct {
 	data.ECDSAPublicKey
@@ -296,26 +302,126 @@ func removeKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte
 	return nil
 }
 
+func listKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[string]yubiSlot, err error) {
+	keys = make(map[string]yubiSlot)
+	findTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
+		//pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
+		pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE),
+	}
+
+	attrTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{0}),
+		pkcs11.NewAttribute(pkcs11.CKA_VALUE, []byte{0}),
+	}
+
+	if err = ctx.FindObjectsInit(session, findTemplate); err != nil {
+		logrus.Debugf("Failed to init: %s\n", err.Error())
+		return
+	}
+	objs, b, err := ctx.FindObjects(session, numSlots)
+	for err == nil {
+		var o []pkcs11.ObjectHandle
+		o, b, err = ctx.FindObjects(session, numSlots)
+		if err != nil {
+			continue
+		}
+		if len(o) == 0 {
+			break
+		}
+		objs = append(objs, o...)
+	}
+	if err != nil {
+		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		if len(objs) == 0 {
+			return nil, err
+		}
+	}
+	if err = ctx.FindObjectsFinal(session); err != nil {
+		logrus.Debugf("Failed to finalize: %s\n", err.Error())
+		return
+	}
+	if len(objs) == 0 {
+		return nil, errors.New("No keys found in yubikey.")
+	}
+	logrus.Debugf("Found %d objects matching list filters", len(objs))
+	for _, obj := range objs {
+		var (
+			cert *x509.Certificate
+			slot []byte
+		)
+		// Retrieve the public-key material to be able to create a new HSMRSAKey
+		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
+		if err != nil {
+			logrus.Debugf("Failed to get Attribute for: %v\n", obj)
+			continue
+		}
+
+		// Iterate through all the attributes of this key and saves CKA_PUBLIC_EXPONENT and CKA_MODULUS. Removes ordering specific issues.
+		for _, a := range attr {
+			if a.Type == pkcs11.CKA_ID {
+				slot = a.Value
+			}
+			if a.Type == pkcs11.CKA_VALUE {
+				cert, err = x509.ParseCertificate(a.Value)
+				if err != nil {
+					continue
+				}
+				if !data.ValidRole(cert.Subject.CommonName) {
+					continue
+				}
+			}
+		}
+		var ecdsaPubKey *ecdsa.PublicKey
+		switch cert.PublicKeyAlgorithm {
+		case x509.ECDSA:
+			ecdsaPubKey = cert.PublicKey.(*ecdsa.PublicKey)
+		default:
+			logrus.Infof("Unsupported x509 PublicKeyAlgorithm: %d", cert.PublicKeyAlgorithm)
+			continue
+		}
+
+		pubBytes, err := x509.MarshalPKIXPublicKey(ecdsaPubKey)
+		if err != nil {
+			logrus.Debugf("Failed to Marshal public key")
+			continue
+		}
+
+		keys[data.NewECDSAPublicKey(pubBytes).ID()] = yubiSlot{
+			role:   cert.Subject.CommonName,
+			slotID: slot,
+		}
+	}
+	return
+}
+
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
+	keys          map[string]yubiSlot
 }
 
 func NewYubiKeyStore(passphraseRetriever passphrase.Retriever) *YubiKeyStore {
-	return &YubiKeyStore{passRetriever: passphraseRetriever}
+	return &YubiKeyStore{
+		passRetriever: passphraseRetriever,
+		keys:          make(map[string]yubiSlot),
+	}
 }
 
 func (s *YubiKeyStore) ListKeys() map[string]string {
+	if len(s.keys) > 0 {
+		return buildKeyMap(s.keys)
+	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
 		return nil
 	}
 	defer cleanup(ctx, session)
-	ecdsaPubKey, alias, err := getECDSAKey(ctx, session, YUBIKEY_ROOT_KEY_ID)
+	keys, err := listKeys(ctx, session)
 	if err != nil {
-		logrus.Debugf("error while listing keys from Yubikey: %s", err)
 		return nil
 	}
-	return map[string]string{ecdsaPubKey.ID(): alias}
+	s.keys = keys
+	return buildKeyMap(keys)
 }
 
 func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) error {
@@ -330,7 +436,8 @@ func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) erro
 	}
 	defer cleanup(ctx, session)
 
-	return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID, s.passRetriever)
+	//return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID, s.passRetriever)
+	return addECDSAKey(ctx, session, privKey, []byte{3}, s.passRetriever)
 }
 
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
@@ -452,3 +559,11 @@ func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphra
 	}
 	return nil
 }
+
+func buildKeyMap(keys map[string]yubiSlot) map[string]string {
+	res := make(map[string]string)
+	for k, v := range keys {
+		res[k] = v.role
+	}
+	return res
+}

From 0fd1fa6ada02500da2dc3d5f3c50cb48680cb15b Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Thu, 5 Nov 2015 13:48:03 -0800
Subject: [PATCH 23/85] arbitrary slots working Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 cryptoservice/crypto_service.go             |   2 +-
 signer/api/ecdsa_hardware_crypto_service.go | 111 +++++++++++++++++---
 trustmanager/keyfilestore.go                |   4 +-
 tuf/signed/ed25519.go                       |   2 +-
 4 files changed, 102 insertions(+), 17 deletions(-)

diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 8b07a77d91..4065df0f45 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -164,7 +164,7 @@ func (cs *CryptoService) ListKeys(role string) []string {
 	return res
 }
 
-// ListKeys returns a list of key IDs valid for the given role
+// ListAllKeys returns a map of key IDs to role
 func (cs *CryptoService) ListAllKeys() map[string]string {
 	res := make(map[string]string)
 	for _, ks := range cs.keyStores {
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 9cf1d66035..1042f24d20 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -39,16 +39,18 @@ type yubiSlot struct {
 type YubiPrivateKey struct {
 	data.ECDSAPublicKey
 	passRetriever passphrase.Retriever
+	slot          []byte
 }
 
 type YubikeySigner struct {
 	YubiPrivateKey
 }
 
-func NewYubiPrivateKey(pubKey data.ECDSAPublicKey, passRetriever passphrase.Retriever) *YubiPrivateKey {
+func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey, passRetriever passphrase.Retriever) *YubiPrivateKey {
 	return &YubiPrivateKey{
 		ECDSAPublicKey: pubKey,
 		passRetriever:  passRetriever,
+		slot:           slot,
 	}
 }
 
@@ -85,7 +87,7 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 	}
 	defer cleanup(ctx, session)
 
-	sig, err := sign(ctx, session, YUBIKEY_ROOT_KEY_ID, y.passRetriever, msg)
+	sig, err := sign(ctx, session, y.slot, y.passRetriever, msg)
 	if err != nil {
 		return nil, fmt.Errorf("failed to sign using Yubikey: %v", err)
 	}
@@ -94,7 +96,7 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 }
 
 // addECDSAKey adds a key to the yubikey
-func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever) error {
+func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever, role string) error {
 	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
 
 	// TODO(diogo): Figure out CKU_SO with yubikey
@@ -113,7 +115,7 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 	ecdsaPrivKeyD := ecdsaPrivKey.D.Bytes()
 	logrus.Debugf("Getting D bytes: %v\n", ecdsaPrivKeyD)
 
-	template, err := trustmanager.NewCertificate(data.CanonicalRootRole)
+	template, err := trustmanager.NewCertificate(role)
 	if err != nil {
 		return fmt.Errorf("failed to create the certificate template: %v", err)
 	}
@@ -395,16 +397,80 @@ func listKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[string]yu
 	return
 }
 
+func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, error) {
+	findTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
+	}
+	attrTemplate := []*pkcs11.Attribute{
+		pkcs11.NewAttribute(pkcs11.CKA_ID, []byte{0}),
+	}
+
+	if err := ctx.FindObjectsInit(session, findTemplate); err != nil {
+		logrus.Debugf("Failed to init: %s\n", err.Error())
+		return nil, err
+	}
+	objs, b, err := ctx.FindObjects(session, numSlots)
+	for err == nil {
+		var o []pkcs11.ObjectHandle
+		o, b, err = ctx.FindObjects(session, numSlots)
+		if err != nil {
+			continue
+		}
+		if len(o) == 0 {
+			break
+		}
+		objs = append(objs, o...)
+	}
+	taken := make([]bool, numSlots)
+	if err != nil {
+		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		return nil, err
+	}
+	for _, obj := range objs {
+		// Retrieve the public-key material to be able to create a new HSMRSAKey
+		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
+		if err != nil {
+			logrus.Debugf("Failed to get Attribute for: %v\n", obj)
+			continue
+		}
+
+		// Iterate through all the attributes of this key and saves CKA_PUBLIC_EXPONENT and CKA_MODULUS. Removes ordering specific issues.
+		for _, a := range attr {
+			if a.Type == pkcs11.CKA_ID {
+				if len(a.Value) < 1 {
+					continue
+				}
+				// max 50 slots so a single byte will always represent
+				// all possible slots positions
+				slotNum := int(a.Value[0])
+				if slotNum >= len(taken) {
+					// defensive
+					continue
+				}
+				taken[slotNum] = true
+			}
+		}
+	}
+	for i := 0; i < numSlots; i++ {
+		if !taken[i] {
+			return []byte{byte(i)}, nil
+		}
+	}
+	return nil, errors.New("Yubikey has no available slots.")
+}
+
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
 }
 
 func NewYubiKeyStore(passphraseRetriever passphrase.Retriever) *YubiKeyStore {
-	return &YubiKeyStore{
+	s := &YubiKeyStore{
 		passRetriever: passphraseRetriever,
 		keys:          make(map[string]yubiSlot),
 	}
+	s.ListKeys() // populate keys field
+	return s
 }
 
 func (s *YubiKeyStore) ListKeys() map[string]string {
@@ -424,10 +490,10 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 	return buildKeyMap(keys)
 }
 
-func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) error {
+func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error {
 	// We only allow adding root keys for now
-	if alias != data.CanonicalRootRole {
-		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s\n", alias, keyID)
+	if role != data.CanonicalRootRole {
+		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s\n", role, keyID)
 	}
 
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
@@ -436,8 +502,18 @@ func (s *YubiKeyStore) AddKey(keyID, alias string, privKey data.PrivateKey) erro
 	}
 	defer cleanup(ctx, session)
 
-	//return addECDSAKey(ctx, session, privKey, YUBIKEY_ROOT_KEY_ID, s.passRetriever)
-	return addECDSAKey(ctx, session, privKey, []byte{3}, s.passRetriever)
+	if k, ok := s.keys[keyID]; ok {
+		if k.role == role {
+
+		}
+	}
+
+	slot, err := getNextEmptySlot(ctx, session)
+	if err != nil {
+		return err
+	}
+	logrus.Debugf("Using yubikey slot %v", slot)
+	return addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role)
 }
 
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
@@ -447,7 +523,12 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	}
 	defer cleanup(ctx, session)
 
-	pubKey, alias, err := getECDSAKey(ctx, session, YUBIKEY_ROOT_KEY_ID)
+	key, ok := s.keys[keyID]
+	if !ok {
+		return nil, "", errors.New("no matching keys found inside of yubikey")
+	}
+
+	pubKey, alias, err := getECDSAKey(ctx, session, key.slotID)
 	if err != nil {
 		return nil, "", err
 	}
@@ -455,7 +536,7 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	if pubKey.ID() != keyID {
 		return nil, "", fmt.Errorf("expected root key: %s, but found: %s\n", keyID, pubKey.ID())
 	}
-	privKey := NewYubiPrivateKey(*pubKey, s.passRetriever)
+	privKey := NewYubiPrivateKey(key.slotID, *pubKey, s.passRetriever)
 	if privKey == nil {
 		return nil, "", errors.New("could not initialize new YubiPrivateKey")
 	}
@@ -469,7 +550,11 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 		return nil
 	}
 	defer cleanup(ctx, session)
-	return removeKey(ctx, session, YUBIKEY_ROOT_KEY_ID, s.passRetriever, keyID)
+	key, ok := s.keys[keyID]
+	if !ok {
+		return errors.New("Key not present in yubikey")
+	}
+	return removeKey(ctx, session, key.slotID, s.passRetriever, keyID)
 }
 
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index ecc9af9709..e364669e46 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -268,8 +268,8 @@ func getRawKey(s LimitedFileStore, name string) ([]byte, string, error) {
 	return keyBytes, keyAlias, nil
 }
 
-// Get the password to decript the given pem bytes.  Return the password,
-// because it is useful for importing
+// GetPasswdDecryptBytes gets the password to decript the given pem bytes.
+// Returns the password and private key
 func GetPasswdDecryptBytes(passphraseRetriever passphrase.Retriever, pemBytes []byte, name, alias string) (data.PrivateKey, string, error) {
 	var (
 		passwd  string
diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index 1b9536b163..4aabb2403c 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -49,7 +49,7 @@ func (e *Ed25519) ListKeys(role string) []string {
 	return keyIDs
 }
 
-// ListKeys returns the list of keys IDs for the role
+// ListAllKeys returns the map of keys IDs to role
 func (e *Ed25519) ListAllKeys() map[string]string {
 	keys := make(map[string]string)
 	for id, edKey := range e.keys {

From b7c38f0287d03960ed7fec3cfebba9a471855221 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Thu, 5 Nov 2015 16:05:09 -0800
Subject: [PATCH 24/85] fixing tests Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 client/repo.go                              |   3 +-
 client/repo_pkcs11.go                       |   3 +-
 cmd/notary/cert.go                          |   5 +-
 cmd/notary/keys.go                          |  18 +-
 const.go                                    |   6 +
 cryptoservice/crypto_service.go             |  24 +-
 cryptoservice/import_export.go              |  22 +-
 cryptoservice/import_export_test.go         | 841 +++++++++----------
 keystoremanager/keystoremanager.go          |   4 +-
 keystoremanager/keystoremanager_test.go     | 867 ++++++++++----------
 signer/api/ecdsa_hardware_crypto_service.go |   3 +-
 trustmanager/keyfilestore.go                |   9 +-
 12 files changed, 886 insertions(+), 919 deletions(-)
 create mode 100644 const.go

diff --git a/client/repo.go b/client/repo.go
index c2b0b20278..97cba741af 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"path/filepath"
 
+	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
@@ -19,7 +20,7 @@ import (
 // (usually ~/.docker/trust/).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
-	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(baseDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index 8186e1a497..5f6fc7792e 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"path/filepath"
 
+	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
@@ -21,7 +22,7 @@ import (
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 
-	keysPath := filepath.Join(baseDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(baseDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index 21223bcf8a..b4357980e5 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/docker/notary"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/trustmanager"
 
@@ -56,7 +57,7 @@ func certRemove(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -125,7 +126,7 @@ func certList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index b6e0d226fa..36c5d578ba 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -8,9 +8,9 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
@@ -115,7 +115,7 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -157,7 +157,7 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -213,7 +213,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -225,7 +225,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 		fatalf("failed to create a new root key: %v", err)
 	}
 
-	fmt.Printf("Generated new %s key with keyID: %s\n", algorithm, pubKey.ID())
+	fmt.Printf("Generated new %s root key with keyID: %s\n", algorithm, pubKey.ID())
 }
 
 // keysExport exports a collection of keys to a ZIP file
@@ -239,7 +239,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -284,7 +284,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -321,7 +321,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
@@ -352,7 +352,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, keystoremanager.PrivDir)
+	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
diff --git a/const.go b/const.go
new file mode 100644
index 0000000000..5b1734a9a7
--- /dev/null
+++ b/const.go
@@ -0,0 +1,6 @@
+package notary
+
+// application wide constants
+const (
+	PrivDir = "private"
+)
diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 4065df0f45..8aa0f214f7 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -57,10 +57,10 @@ func (cs *CryptoService) Create(role, algorithm string) (data.PublicKey, error)
 	if role == data.CanonicalRootRole {
 		keyPath = privKey.ID()
 	} else {
-		keyPath = filepath.Join(ccs.gun, privKey.ID())
+		keyPath = filepath.Join(cs.gun, privKey.ID())
 	}
 
-	for _, ks := range ccs.keyStores {
+	for _, ks := range cs.keyStores {
 		err = ks.AddKey(keyPath, role, privKey)
 		if err == nil {
 			return data.PublicKeyFromPrivate(privKey), nil
@@ -77,11 +77,11 @@ func (cs *CryptoService) Create(role, algorithm string) (data.PublicKey, error)
 // without a GUN (in which case it's a root key).  If that fails, try to get
 // the key with the GUN (non-root key).
 // If that fails, then we don't have the key.
-func (ccs *CryptoService) GetPrivateKey(keyID string) (k data.PrivateKey, id string, err error) {
-	keyPaths := []string{keyID, filepath.Join(ccs.gun, keyID)}
-	for _, ks := range ccs.keyStores {
+func (cs *CryptoService) GetPrivateKey(keyID string) (k data.PrivateKey, role string, err error) {
+	keyPaths := []string{keyID, filepath.Join(cs.gun, keyID)}
+	for _, ks := range cs.keyStores {
 		for _, keyPath := range keyPaths {
-			k, id, err = ks.GetKey(keyPath)
+			k, role, err = ks.GetKey(keyPath)
 			if err != nil {
 				continue
 			}
@@ -92,8 +92,8 @@ func (ccs *CryptoService) GetPrivateKey(keyID string) (k data.PrivateKey, id str
 }
 
 // GetKey returns a key by ID
-func (ccs *CryptoService) GetKey(keyID string) data.PublicKey {
-	privKey, _, err := ccs.GetPrivateKey(keyID)
+func (cs *CryptoService) GetKey(keyID string) data.PublicKey {
+	privKey, _, err := cs.GetPrivateKey(keyID)
 	if err != nil {
 		return nil
 	}
@@ -101,9 +101,9 @@ func (ccs *CryptoService) GetKey(keyID string) data.PublicKey {
 }
 
 // RemoveKey deletes a key by ID
-func (ccs *CryptoService) RemoveKey(keyID string) (err error) {
-	keyPaths := []string{keyID, filepath.Join(ccs.gun, keyID)}
-	for _, ks := range ccs.keyStores {
+func (cs *CryptoService) RemoveKey(keyID string) (err error) {
+	keyPaths := []string{keyID, filepath.Join(cs.gun, keyID)}
+	for _, ks := range cs.keyStores {
 		for _, keyPath := range keyPaths {
 			_, _, err = ks.GetKey(keyPath)
 			if err != nil {
@@ -124,7 +124,7 @@ func (cs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature
 	for _, keyid := range keyIDs {
 		keyName := keyid
 
-		privKey, _, err := ccs.GetPrivateKey(keyName)
+		privKey, _, err := cs.GetPrivateKey(keyName)
 		if err != nil {
 			logrus.Debugf("error attempting to retrieve private key: %s, %v", keyid, err)
 			continue
diff --git a/cryptoservice/import_export.go b/cryptoservice/import_export.go
index ddc3e3b899..922779b789 100644
--- a/cryptoservice/import_export.go
+++ b/cryptoservice/import_export.go
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/docker/notary/keystoremanager"
+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 )
@@ -72,7 +72,7 @@ func (cs *CryptoService) ExportRootKeyReencrypt(dest io.Writer, keyID string, ne
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)
 
-	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
+	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
 	if err != nil {
 		return err
@@ -127,7 +127,7 @@ func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever pa
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
+	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
 	if err != nil {
 		return err
@@ -141,7 +141,7 @@ func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever pa
 
 	zipWriter := zip.NewWriter(dest)
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, keystoremanager.PrivDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore, notary.PrivDir); err != nil {
 		return err
 	}
 
@@ -176,13 +176,13 @@ func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader) error {
 
 		// Note that using / as a separator is okay here - the zip
 		// package guarantees that the separator will be /
-		if strings.HasPrefix(fNameTrimmed, keystoremanager.PrivDir) {
+		if strings.HasPrefix(fNameTrimmed, notary.PrivDir) {
 			if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
 				if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
 					return err
 				}
 			}
-			keyName := strings.TrimPrefix(fNameTrimmed, keystoremanager.PrivDir)
+			keyName := strings.TrimPrefix(fNameTrimmed, notary.PrivDir)
 			newKeys[keyName] = fileBytes
 		} else {
 			// This path inside the zip archive doesn't look like a
@@ -194,9 +194,11 @@ func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader) error {
 	}
 
 	for keyName, pemBytes := range newKeys {
-		parts := strings.Split(keyName, "_")
+		if keyName[len(keyName)-5:] == "_root" {
+			keyName = "root"
+		}
 		for _, ks := range cs.keyStores {
-			if err := ks.ImportKey(pemBytes, parts[1]); err != nil {
+			if err := ks.ImportKey(pemBytes, keyName); err != nil {
 				return err
 			}
 		}
@@ -213,7 +215,7 @@ func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseR
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, keystoremanager.PrivDir)
+	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
 	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, passphraseRetriever)
 	if err != nil {
 		return err
@@ -231,7 +233,7 @@ func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseR
 		return ErrNoKeysFoundForGUN
 	}
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, keystoremanager.PrivDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore, notary.PrivDir); err != nil {
 		return err
 	}
 
diff --git a/cryptoservice/import_export_test.go b/cryptoservice/import_export_test.go
index 1db796696d..6b9ced61b4 100644
--- a/cryptoservice/import_export_test.go
+++ b/cryptoservice/import_export_test.go
@@ -1,447 +1,398 @@
 package cryptoservice
 
-//import (
-//	"archive/zip"
-//	"bytes"
-//	"fmt"
-//	"io/ioutil"
-//	"net/http"
-//	"net/http/httptest"
-//	"os"
-//	"path/filepath"
-//	"strings"
-//	"testing"
-//
-//	"github.com/docker/notary/client"
-//	"github.com/docker/notary/keystoremanager"
-//	"github.com/docker/notary/trustmanager"
-//	"github.com/docker/notary/tuf/data"
-//	"github.com/stretchr/testify/assert"
-//)
-//
-//const timestampECDSAKeyJSON = `
-//{"keytype":"ecdsa","keyval":{"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw==","private":"MHcCAQEEIDqtcdzU7H3AbIPSQaxHl9+xYECt7NpK7B1+6ep5cv9CoAoGCCqGSM49AwEHoUQDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}`
-//
-//func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
-//	mux := http.NewServeMux()
-//	// TUF will request /v2/docker.com/notary/_trust/tuf/timestamp.key
-//	// Return a canned timestamp.key
-//	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.key", func(w http.ResponseWriter, r *http.Request) {
-//		// Also contains the private key, but for the purpose of this
-//		// test, we don't care
-//		fmt.Fprint(w, timestampECDSAKeyJSON)
-//	})
-//
-//	ts := httptest.NewServer(mux)
-//
-//	return ts, mux
-//}
-//
-//var oldPassphrase = "oldPassphrase"
-//var exportPassphrase = "exportPassphrase"
-//var oldPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return oldPassphrase, false, nil }
-//var newPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return exportPassphrase, false, nil }
-//
-//func TestImportExportZip(t *testing.T) {
-//	gun := "docker.com/notary"
-//
-//	// Temporary directory where test files will be created
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	ts, _ := createTestServer(t)
-//	defer ts.Close()
-//
-//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo.Initialize(rootKeyID)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
-//	tempZipFilePath := tempZipFile.Name()
-//	defer os.Remove(tempZipFilePath)
-//
-//	err = repo.KeyStoreManager.ExportAllKeys(tempZipFile, newPassphraseRetriever)
-//	tempZipFile.Close()
-//	assert.NoError(t, err)
-//
-//	// Reopen the zip file for importing
-//	zipReader, err := zip.OpenReader(tempZipFilePath)
-//	assert.NoError(t, err, "could not open zip file")
-//
-//	// Map of files to expect in the zip file, with the passphrases
-//	passphraseByFile := make(map[string]string)
-//
-//	// Add non-root keys to the map. These should use the new passphrase
-//	// because the passwords were chosen by the newPassphraseRetriever.
-//	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
-//	for privKeyName := range privKeyMap {
-//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-//		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
-//
-//		if alias == "root" {
-//			continue
-//		}
-//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-//		passphraseByFile[relKeyPath] = exportPassphrase
-//	}
-//
-//	// Add root key to the map. This will use the export passphrase because it
-//	// will be reencrypted.
-//	relRootKey := filepath.Join("private", "root_keys", rootKeyID+"_root.key")
-//	passphraseByFile[relRootKey] = exportPassphrase
-//
-//	// Iterate through the files in the archive, checking that the files
-//	// exist and are encrypted with the expected passphrase.
-//	for _, f := range zipReader.File {
-//		expectedPassphrase, present := passphraseByFile[f.Name]
-//		if !present {
-//			t.Fatalf("unexpected file %s in zip file", f.Name)
-//		}
-//
-//		delete(passphraseByFile, f.Name)
-//
-//		rc, err := f.Open()
-//		assert.NoError(t, err, "could not open file inside zip archive")
-//
-//		pemBytes, err := ioutil.ReadAll(rc)
-//		assert.NoError(t, err, "could not read file from zip")
-//
-//		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
-//		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
-//
-//		rc.Close()
-//	}
-//
-//	zipReader.Close()
-//
-//	// Are there any keys that didn't make it to the zip?
-//	for fileNotFound := range passphraseByFile {
-//		t.Fatalf("%s not found in zip", fileNotFound)
-//	}
-//
-//	// Create new repo to test import
-//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir2)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo2.Initialize(rootKeyID2)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	// Reopen the zip file for importing
-//	zipReader, err = zip.OpenReader(tempZipFilePath)
-//	assert.NoError(t, err, "could not open zip file")
-//
-//	// Now try with a valid passphrase. This time it should succeed.
-//	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
-//	assert.NoError(t, err)
-//	zipReader.Close()
-//
-//	// Look for keys in private. The filenames should match the key IDs
-//	// in the repo's private key store.
-//	for privKeyName := range privKeyMap {
-//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-//		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
-//
-//		if alias == "root" {
-//			continue
-//		}
-//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-//		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
-//		_, err = os.Stat(privKeyFileName)
-//		assert.NoError(t, err, "missing private key: %s", privKeyName)
-//	}
-//
-//	// Look for keys in root_keys
-//	// There should be a file named after the key ID of the root key we
-//	// passed in.
-//	rootKeyFilename := rootKeyID + "_root.key"
-//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-//	assert.NoError(t, err, "missing root key")
-//}
-//
-//func TestImportExportGUN(t *testing.T) {
-//	gun := "docker.com/notary"
-//
-//	// Temporary directory where test files will be created
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	ts, _ := createTestServer(t)
-//	defer ts.Close()
-//
-//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo.Initialize(rootKeyID)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
-//	tempZipFilePath := tempZipFile.Name()
-//	defer os.Remove(tempZipFilePath)
-//
-//	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, gun, newPassphraseRetriever)
-//	assert.NoError(t, err)
-//
-//	// With an invalid GUN, this should return an error
-//	err = repo.KeyStoreManager.ExportKeysByGUN(tempZipFile, "does.not.exist/in/repository", newPassphraseRetriever)
-//	assert.EqualError(t, err, keystoremanager.ErrNoKeysFoundForGUN.Error())
-//
-//	tempZipFile.Close()
-//
-//	// Reopen the zip file for importing
-//	zipReader, err := zip.OpenReader(tempZipFilePath)
-//	assert.NoError(t, err, "could not open zip file")
-//
-//	// Map of files to expect in the zip file, with the passphrases
-//	passphraseByFile := make(map[string]string)
-//
-//	// Add keys non-root keys to the map. These should use the new passphrase
-//	// because they were formerly unencrypted.
-//	privKeyMap := repo.KeyStoreManager.KeyStore.ListKeys()
-//	for privKeyName := range privKeyMap {
-//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-//		if err != nil {
-//			t.Fatalf("privKey %s has no alias", privKeyName)
-//		}
-//		if alias == "root" {
-//			continue
-//		}
-//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-//
-//		passphraseByFile[relKeyPath] = exportPassphrase
-//	}
-//
-//	// Iterate through the files in the archive, checking that the files
-//	// exist and are encrypted with the expected passphrase.
-//	for _, f := range zipReader.File {
-//
-//		expectedPassphrase, present := passphraseByFile[f.Name]
-//		if !present {
-//			t.Fatalf("unexpected file %s in zip file", f.Name)
-//		}
-//
-//		delete(passphraseByFile, f.Name)
-//
-//		rc, err := f.Open()
-//		assert.NoError(t, err, "could not open file inside zip archive")
-//
-//		pemBytes, err := ioutil.ReadAll(rc)
-//		assert.NoError(t, err, "could not read file from zip")
-//
-//		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
-//		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
-//
-//		rc.Close()
-//	}
-//
-//	zipReader.Close()
-//
-//	// Are there any keys that didn't make it to the zip?
-//	for fileNotFound := range passphraseByFile {
-//		t.Fatalf("%s not found in zip", fileNotFound)
-//	}
-//
-//	// Create new repo to test import
-//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir2)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo2.Initialize(rootKeyID2)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	// Reopen the zip file for importing
-//	zipReader, err = zip.OpenReader(tempZipFilePath)
-//	assert.NoError(t, err, "could not open zip file")
-//
-//	// Now try with a valid passphrase. This time it should succeed.
-//	err = repo2.KeyStoreManager.ImportKeysZip(zipReader.Reader)
-//	assert.NoError(t, err)
-//	zipReader.Close()
-//
-//	// Look for keys in private. The filenames should match the key IDs
-//	// in the repo's private key store.
-//	for privKeyName := range privKeyMap {
-//		_, alias, err := repo.KeyStoreManager.KeyStore.GetKey(privKeyName)
-//		if err != nil {
-//			t.Fatalf("privKey %s has no alias", privKeyName)
-//		}
-//		if alias == "root" {
-//			continue
-//		}
-//		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-//		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
-//		_, err = os.Stat(privKeyFileName)
-//	}
-//}
-//
-//func TestImportExportRootKey(t *testing.T) {
-//	gun := "docker.com/notary"
-//
-//	// Temporary directory where test files will be created
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	ts, _ := createTestServer(t)
-//	defer ts.Close()
-//
-//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo.Initialize(rootKeyID)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
-//	tempKeyFilePath := tempKeyFile.Name()
-//	defer os.Remove(tempKeyFilePath)
-//
-//	err = repo.KeyStoreManager.ExportRootKey(tempKeyFile, rootKeyID)
-//	assert.NoError(t, err)
-//	tempKeyFile.Close()
-//
-//	// Create new repo to test import
-//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir2)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo2.Initialize(rootKeyID2)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	keyReader, err := os.Open(tempKeyFilePath)
-//	assert.NoError(t, err, "could not open key file")
-//
-//	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
-//	assert.NoError(t, err)
-//	keyReader.Close()
-//
-//	// Look for repo's root key in repo2
-//	// There should be a file named after the key ID of the root key we
-//	// imported.
-//	rootKeyFilename := rootKeyID + "_root.key"
-//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-//	assert.NoError(t, err, "missing root key")
-//
-//	// Try to import a decrypted version of the root key and make sure it
-//	// doesn't succeed
-//	pemBytes, err := ioutil.ReadFile(tempKeyFilePath)
-//	assert.NoError(t, err, "could not read key file")
-//	privKey, err := trustmanager.ParsePEMPrivateKey(pemBytes, oldPassphrase)
-//	assert.NoError(t, err, "could not decrypt key file")
-//	decryptedPEMBytes, err := trustmanager.KeyToPEM(privKey)
-//	assert.NoError(t, err, "could not convert key to PEM")
-//
-//	err = repo2.KeyStoreManager.ImportRootKey(bytes.NewReader(decryptedPEMBytes))
-//	assert.EqualError(t, err, keystoremanager.ErrRootKeyNotEncrypted.Error())
-//
-//	// Try to import garbage and make sure it doesn't succeed
-//	err = repo2.KeyStoreManager.ImportRootKey(strings.NewReader("this is not PEM"))
-//	assert.EqualError(t, err, keystoremanager.ErrNoValidPrivateKey.Error())
-//
-//	// Should be able to unlock the root key with the old password
-//	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
-//	assert.NoError(t, err, "could not unlock root key")
-//	assert.Equal(t, "root", alias)
-//	assert.Equal(t, rootKeyID, key.ID())
-//}
-//
-//func TestImportExportRootKeyReencrypt(t *testing.T) {
-//	gun := "docker.com/notary"
-//
-//	// Temporary directory where test files will be created
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	ts, _ := createTestServer(t)
-//	defer ts.Close()
-//
-//	repo, err := client.NewNotaryRepository(tempBaseDir, gun, ts.URL, http.DefaultTransport, oldPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID, err := repo.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo.Initialize(rootKeyID)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
-//	tempKeyFilePath := tempKeyFile.Name()
-//	defer os.Remove(tempKeyFilePath)
-//
-//	err = repo.KeyStoreManager.ExportRootKeyReencrypt(tempKeyFile, rootKeyID, newPassphraseRetriever)
-//	assert.NoError(t, err)
-//	tempKeyFile.Close()
-//
-//	// Create new repo to test import
-//	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir2)
-//
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	repo2, err := client.NewNotaryRepository(tempBaseDir2, gun, ts.URL, http.DefaultTransport, newPassphraseRetriever)
-//	assert.NoError(t, err, "error creating repo: %s", err)
-//
-//	rootKeyID2, err := repo2.KeyStoreManager.GenRootKey(data.ECDSAKey)
-//	assert.NoError(t, err, "error generating root key: %s", err)
-//
-//	err = repo2.Initialize(rootKeyID2)
-//	assert.NoError(t, err, "error creating repository: %s", err)
-//
-//	keyReader, err := os.Open(tempKeyFilePath)
-//	assert.NoError(t, err, "could not open key file")
-//
-//	err = repo2.KeyStoreManager.ImportRootKey(keyReader)
-//	assert.NoError(t, err)
-//	keyReader.Close()
-//
-//	// Look for repo's root key in repo2
-//	// There should be a file named after the key ID of the root key we
-//	// imported.
-//	rootKeyFilename := rootKeyID + "_root.key"
-//	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
-//	assert.NoError(t, err, "missing root key")
-//
-//	// Should be able to unlock the root key with the new password
-//	key, alias, err := repo2.KeyStoreManager.KeyStore.GetKey(rootKeyID)
-//	assert.NoError(t, err, "could not unlock root key")
-//	assert.Equal(t, "root", alias)
-//	assert.Equal(t, rootKeyID, key.ID())
-//}
+import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/tuf/data"
+	"github.com/stretchr/testify/assert"
+)
+
+const timestampECDSAKeyJSON = `
+{"keytype":"ecdsa","keyval":{"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw==","private":"MHcCAQEEIDqtcdzU7H3AbIPSQaxHl9+xYECt7NpK7B1+6ep5cv9CoAoGCCqGSM49AwEHoUQDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}`
+
+func createTestServer(t *testing.T) (*httptest.Server, *http.ServeMux) {
+	mux := http.NewServeMux()
+	// TUF will request /v2/docker.com/notary/_trust/tuf/timestamp.key
+	// Return a canned timestamp.key
+	mux.HandleFunc("/v2/docker.com/notary/_trust/tuf/timestamp.key", func(w http.ResponseWriter, r *http.Request) {
+		// Also contains the private key, but for the purpose of this
+		// test, we don't care
+		fmt.Fprint(w, timestampECDSAKeyJSON)
+	})
+
+	ts := httptest.NewServer(mux)
+
+	return ts, mux
+}
+
+var oldPassphrase = "oldPassphrase"
+var exportPassphrase = "exportPassphrase"
+var oldPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return oldPassphrase, false, nil }
+var newPassphraseRetriever = func(string, string, bool, int) (string, bool, error) { return exportPassphrase, false, nil }
+
+func TestImportExportZip(t *testing.T) {
+	gun := "docker.com/notary"
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), newPassphraseRetriever)
+	cs := NewCryptoService(gun, fileStore)
+	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
+	assert.NoError(t, err)
+
+	rootKeyID := pubKey.ID()
+
+	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
+	tempZipFilePath := tempZipFile.Name()
+	defer os.Remove(tempZipFilePath)
+
+	err = cs.ExportAllKeys(tempZipFile, newPassphraseRetriever)
+	tempZipFile.Close()
+	assert.NoError(t, err)
+
+	// Reopen the zip file for importing
+	zipReader, err := zip.OpenReader(tempZipFilePath)
+	assert.NoError(t, err, "could not open zip file")
+
+	// Map of files to expect in the zip file, with the passphrases
+	passphraseByFile := make(map[string]string)
+
+	// Add non-root keys to the map. These should use the new passphrase
+	// because the passwords were chosen by the newPassphraseRetriever.
+	privKeyMap := cs.ListAllKeys()
+	for privKeyName := range privKeyMap {
+		_, alias, err := cs.GetPrivateKey(privKeyName)
+		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
+
+		if alias == "root" {
+			continue
+		}
+		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+		passphraseByFile[relKeyPath] = exportPassphrase
+	}
+
+	// Add root key to the map. This will use the export passphrase because it
+	// will be reencrypted.
+	relRootKey := filepath.Join("private", "root_keys", rootKeyID+"_root.key")
+	passphraseByFile[relRootKey] = exportPassphrase
+
+	// Iterate through the files in the archive, checking that the files
+	// exist and are encrypted with the expected passphrase.
+	for _, f := range zipReader.File {
+		expectedPassphrase, present := passphraseByFile[f.Name]
+		if !present {
+			t.Fatalf("unexpected file %s in zip file", f.Name)
+		}
+
+		delete(passphraseByFile, f.Name)
+
+		rc, err := f.Open()
+		assert.NoError(t, err, "could not open file inside zip archive")
+
+		pemBytes, err := ioutil.ReadAll(rc)
+		assert.NoError(t, err, "could not read file from zip")
+
+		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
+		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
+
+		rc.Close()
+	}
+
+	zipReader.Close()
+
+	// Are there any keys that didn't make it to the zip?
+	for fileNotFound := range passphraseByFile {
+		t.Fatalf("%s not found in zip", fileNotFound)
+	}
+
+	// Create new repo to test import
+	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir2)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	assert.NoError(t, err)
+	cs2 := NewCryptoService(gun, fileStore2)
+
+	// Reopen the zip file for importing
+	zipReader, err = zip.OpenReader(tempZipFilePath)
+	assert.NoError(t, err, "could not open zip file")
+
+	// Now try with a valid passphrase. This time it should succeed.
+	err = cs2.ImportKeysZip(zipReader.Reader)
+	assert.NoError(t, err)
+	zipReader.Close()
+
+	// Look for keys in private. The filenames should match the key IDs
+	// in the repo's private key store.
+	for privKeyName := range privKeyMap {
+		_, alias, err := cs2.GetPrivateKey(privKeyName)
+		assert.NoError(t, err, "privKey %s has no alias", privKeyName)
+
+		if alias == "root" {
+			continue
+		}
+		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+		_, err = os.Stat(privKeyFileName)
+		assert.NoError(t, err, "missing private key for role %s: %s", alias, privKeyName)
+	}
+
+	// Look for keys in root_keys
+	// There should be a file named after the key ID of the root key we
+	// passed in.
+	rootKeyFilename := rootKeyID + "_root.key"
+	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+	assert.NoError(t, err, "missing root key")
+}
+
+func TestImportExportGUN(t *testing.T) {
+	gun := "docker.com/notary"
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), newPassphraseRetriever)
+	cs := NewCryptoService(gun, fileStore)
+	_, err = cs.Create(data.CanonicalRootRole, data.ECDSAKey)
+	_, err = cs.Create(data.CanonicalTargetsRole, data.ECDSAKey)
+	_, err = cs.Create(data.CanonicalSnapshotRole, data.ECDSAKey)
+	assert.NoError(t, err)
+
+	tempZipFile, err := ioutil.TempFile("", "notary-test-export-")
+	tempZipFilePath := tempZipFile.Name()
+	defer os.Remove(tempZipFilePath)
+
+	err = cs.ExportKeysByGUN(tempZipFile, gun, newPassphraseRetriever)
+	assert.NoError(t, err)
+
+	// With an invalid GUN, this should return an error
+	err = cs.ExportKeysByGUN(tempZipFile, "does.not.exist/in/repository", newPassphraseRetriever)
+	assert.EqualError(t, err, ErrNoKeysFoundForGUN.Error())
+
+	tempZipFile.Close()
+
+	// Reopen the zip file for importing
+	zipReader, err := zip.OpenReader(tempZipFilePath)
+	assert.NoError(t, err, "could not open zip file")
+
+	// Map of files to expect in the zip file, with the passphrases
+	passphraseByFile := make(map[string]string)
+
+	// Add keys non-root keys to the map. These should use the new passphrase
+	// because they were formerly unencrypted.
+	privKeyMap := cs.ListAllKeys()
+	for privKeyName := range privKeyMap {
+		_, alias, err := cs.GetPrivateKey(privKeyName)
+		if err != nil {
+			t.Fatalf("privKey %s has no alias", privKeyName)
+		}
+		if alias == "root" {
+			continue
+		}
+		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+
+		passphraseByFile[relKeyPath] = exportPassphrase
+	}
+
+	// Iterate through the files in the archive, checking that the files
+	// exist and are encrypted with the expected passphrase.
+	for _, f := range zipReader.File {
+
+		expectedPassphrase, present := passphraseByFile[f.Name]
+		if !present {
+			t.Fatalf("unexpected file %s in zip file", f.Name)
+		}
+
+		delete(passphraseByFile, f.Name)
+
+		rc, err := f.Open()
+		assert.NoError(t, err, "could not open file inside zip archive")
+
+		pemBytes, err := ioutil.ReadAll(rc)
+		assert.NoError(t, err, "could not read file from zip")
+
+		_, err = trustmanager.ParsePEMPrivateKey(pemBytes, expectedPassphrase)
+		assert.NoError(t, err, "PEM not encrypted with the expected passphrase")
+
+		rc.Close()
+	}
+
+	zipReader.Close()
+
+	// Are there any keys that didn't make it to the zip?
+	for fileNotFound := range passphraseByFile {
+		t.Fatalf("%s not found in zip", fileNotFound)
+	}
+
+	// Create new repo to test import
+	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir2)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	cs2 := NewCryptoService(gun, fileStore2)
+
+	// Reopen the zip file for importing
+	zipReader, err = zip.OpenReader(tempZipFilePath)
+	assert.NoError(t, err, "could not open zip file")
+
+	// Now try with a valid passphrase. This time it should succeed.
+	err = cs2.ImportKeysZip(zipReader.Reader)
+	assert.NoError(t, err)
+	zipReader.Close()
+
+	// Look for keys in private. The filenames should match the key IDs
+	// in the repo's private key store.
+	for privKeyName, role := range privKeyMap {
+		if role == "root" {
+			continue
+		}
+		_, alias, err := cs2.GetPrivateKey(privKeyName)
+		if err != nil {
+			t.Fatalf("privKey %s has no alias", privKeyName)
+		}
+		if alias == "root" {
+			continue
+		}
+		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+		_, err = os.Stat(privKeyFileName)
+		assert.NoError(t, err)
+	}
+}
+
+func TestImportExportRootKey(t *testing.T) {
+	gun := "docker.com/notary"
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), oldPassphraseRetriever)
+	cs := NewCryptoService(gun, fileStore)
+	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
+	assert.NoError(t, err)
+
+	rootKeyID := pubKey.ID()
+
+	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
+	tempKeyFilePath := tempKeyFile.Name()
+	defer os.Remove(tempKeyFilePath)
+
+	err = cs.ExportRootKey(tempKeyFile, rootKeyID)
+	assert.NoError(t, err)
+	tempKeyFile.Close()
+
+	// Create new repo to test import
+	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir2)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), oldPassphraseRetriever)
+	cs2 := NewCryptoService(gun, fileStore2)
+
+	keyReader, err := os.Open(tempKeyFilePath)
+	assert.NoError(t, err, "could not open key file")
+
+	err = cs2.ImportRootKey(keyReader)
+	assert.NoError(t, err)
+	keyReader.Close()
+
+	// Look for repo's root key in repo2
+	// There should be a file named after the key ID of the root key we
+	// imported.
+	rootKeyFilename := rootKeyID + "_root.key"
+	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+	assert.NoError(t, err, "missing root key")
+
+	// Try to import a decrypted version of the root key and make sure it
+	// doesn't succeed
+	pemBytes, err := ioutil.ReadFile(tempKeyFilePath)
+	assert.NoError(t, err, "could not read key file")
+	privKey, err := trustmanager.ParsePEMPrivateKey(pemBytes, oldPassphrase)
+	assert.NoError(t, err, "could not decrypt key file")
+	decryptedPEMBytes, err := trustmanager.KeyToPEM(privKey)
+	assert.NoError(t, err, "could not convert key to PEM")
+
+	err = cs2.ImportRootKey(bytes.NewReader(decryptedPEMBytes))
+	assert.EqualError(t, err, ErrRootKeyNotEncrypted.Error())
+
+	// Try to import garbage and make sure it doesn't succeed
+	err = cs2.ImportRootKey(strings.NewReader("this is not PEM"))
+	assert.EqualError(t, err, ErrNoValidPrivateKey.Error())
+
+	// Should be able to unlock the root key with the old password
+	key, alias, err := cs2.GetPrivateKey(rootKeyID)
+	assert.NoError(t, err, "could not unlock root key")
+	assert.Equal(t, "root", alias)
+	assert.Equal(t, rootKeyID, key.ID())
+}
+
+func TestImportExportRootKeyReencrypt(t *testing.T) {
+	gun := "docker.com/notary"
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), oldPassphraseRetriever)
+	cs := NewCryptoService(gun, fileStore)
+	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
+	assert.NoError(t, err)
+
+	rootKeyID := pubKey.ID()
+
+	tempKeyFile, err := ioutil.TempFile("", "notary-test-export-")
+	tempKeyFilePath := tempKeyFile.Name()
+	defer os.Remove(tempKeyFilePath)
+
+	err = cs.ExportRootKeyReencrypt(tempKeyFile, rootKeyID, newPassphraseRetriever)
+	assert.NoError(t, err)
+	tempKeyFile.Close()
+
+	// Create new repo to test import
+	tempBaseDir2, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir2)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	cs2 := NewCryptoService(gun, fileStore2)
+
+	keyReader, err := os.Open(tempKeyFilePath)
+	assert.NoError(t, err, "could not open key file")
+
+	err = cs2.ImportRootKey(keyReader)
+	assert.NoError(t, err)
+	keyReader.Close()
+
+	// Look for repo's root key in repo2
+	// There should be a file named after the key ID of the root key we
+	// imported.
+	rootKeyFilename := rootKeyID + "_root.key"
+	_, err = os.Stat(filepath.Join(tempBaseDir2, "private", "root_keys", rootKeyFilename))
+	assert.NoError(t, err, "missing root key")
+
+	// Should be able to unlock the root key with the new password
+	key, alias, err := cs2.GetPrivateKey(rootKeyID)
+	assert.NoError(t, err, "could not unlock root key")
+	assert.Equal(t, "root", alias)
+	assert.Equal(t, rootKeyID, key.ID())
+}
diff --git a/keystoremanager/keystoremanager.go b/keystoremanager/keystoremanager.go
index 6b61f1c009..d22da537e0 100644
--- a/keystoremanager/keystoremanager.go
+++ b/keystoremanager/keystoremanager.go
@@ -24,9 +24,7 @@ type KeyStoreManager struct {
 }
 
 const (
-	trustDir = "trusted_certificates"
-	// PrivDir is the name of the private directory
-	PrivDir        = "private"
+	trustDir       = "trusted_certificates"
 	rsaRootKeySize = 4096 // Used for new root keys
 )
 
diff --git a/keystoremanager/keystoremanager_test.go b/keystoremanager/keystoremanager_test.go
index da19c08ad5..1c5d3e316f 100644
--- a/keystoremanager/keystoremanager_test.go
+++ b/keystoremanager/keystoremanager_test.go
@@ -1,435 +1,436 @@
 package keystoremanager
 
-//import (
-//	"bytes"
-//	"crypto/x509"
-//	"encoding/json"
-//	"io/ioutil"
-//	"os"
-//	"path/filepath"
-//	"testing"
-//	"text/template"
-//
-//	"github.com/docker/notary/cryptoservice"
-//	"github.com/docker/notary/trustmanager"
-//	"github.com/docker/notary/tuf/data"
-//	"github.com/docker/notary/tuf/signed"
-//	"github.com/stretchr/testify/assert"
-//)
-//
-//type SignedRSARootTemplate struct {
-//	RootPem string
-//}
-//
-//var passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "passphrase", false, nil }
-//
-//const validPEMEncodedRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZLekNDQXhXZ0F3SUJBZ0lRUnlwOVFxY0pmZDNheXFkaml6OHhJREFMQmdrcWhraUc5dzBCQVFzd09ERWEKTUJnR0ExVUVDaE1SWkc5amEyVnlMbU52YlM5dWIzUmhjbmt4R2pBWUJnTlZCQU1URVdSdlkydGxjaTVqYjIwdgpibTkwWVhKNU1CNFhEVEUxTURjeE56QTJNelF5TTFvWERURTNNRGN4TmpBMk16UXlNMW93T0RFYU1CZ0dBMVVFCkNoTVJaRzlqYTJWeUxtTnZiUzl1YjNSaGNua3hHakFZQmdOVkJBTVRFV1J2WTJ0bGNpNWpiMjB2Ym05MFlYSjUKTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUFvUWZmcnpzWW5zSDh2R2Y0Smg1NQpDajV3cmpVR3pEL3NIa2FGSHB0ako2VG9KR0p2NXlNQVB4enlJbnU1c0lvR0xKYXBuWVZCb0FVMFlnSTlxbEFjCllBNlN4YVN3Z202cnB2bW5sOFFuMHFjNmdlcjNpbnBHYVVKeWxXSHVQd1drdmNpbVFBcUhaeDJkUXRMN2c2a3AKcm1LZVRXcFdvV0x3M0pvQVVaVVZoWk1kNmEyMlpML0R2QXcrSHJvZ2J6NFhleWFoRmI5SUg0MDJ6UHhONnZnYQpKRUZURjBKaTFqdE5nME1vNHBiOVNIc01zaXcrTFpLN1NmZkhWS1B4dmQyMW0vYmlObXdzZ0V4QTNVOE9PRzhwCnV5Z2ZhY3lzNWM4K1pyWCtaRkcvY3Z3S3owazYvUWZKVTQwczZNaFh3NUMyV3R0ZFZtc0c5LzdyR0ZZakhvSUoKd2VEeXhnV2s3dnhLelJKSS91bjdjYWdESWFRc0tySlFjQ0hJR0ZSbHBJUjVUd1g3dmwzUjdjUm5jckRSTVZ2YwpWU0VHMmVzeGJ3N2p0eklwL3lwblZSeGNPbnk3SXlweWpLcVZlcVo2SGd4WnRUQlZyRjFPL2FIbzJrdmx3eVJTCkF1czRrdmg2ejMranpUbTlFemZYaVBRelk5QkVrNWdPTHhoVzlyYzZVaGxTK3BlNWxrYU4vSHlxeS9sUHVxODkKZk1yMnJyN2xmNVdGZEZuemU2V05ZTUFhVzdkTkE0TkUwZHlENTM0MjhaTFh4TlZQTDRXVTY2R2FjNmx5blE4bApyNXRQc1lJRlh6aDZGVmFSS0dRVXRXMWh6OWVjTzZZMjdSaDJKc3lpSXhnVXFrMm9veEU2OXVONDJ0K2R0cUtDCjFzOEcvN1Z0WThHREFMRkxZVG56THZzQ0F3RUFBYU0xTURNd0RnWURWUjBQQVFIL0JBUURBZ0NnTUJNR0ExVWQKSlFRTU1Bb0dDQ3NHQVFVRkJ3TURNQXdHQTFVZEV3RUIvd1FDTUFBd0N3WUpLb1pJaHZjTkFRRUxBNElDQVFCTQpPbGwzRy9YQno4aWRpTmROSkRXVWgrNXczb2ptd2FuclRCZENkcUVrMVdlbmFSNkR0Y2ZsSng2WjNmL213VjRvCmIxc2tPQVgxeVg1UkNhaEpIVU14TWljei9RMzhwT1ZlbEdQclduYzNUSkIrVktqR3lIWGxRRFZrWkZiKzQrZWYKd3RqN0huZ1hoSEZGRFNnam0zRWRNbmR2Z0RRN1NRYjRza09uQ05TOWl5WDdlWHhoRkJDWm1aTCtIQUxLQmoyQgp5aFY0SWNCRHFtcDUwNHQxNHJ4OS9KdnR5MGRHN2ZZN0k1MWdFUXBtNFMwMkpNTDV4dlRtMXhmYm9XSWhaT0RJCnN3RUFPK2VrQm9GSGJTMVE5S01QaklBdzNUckNISDh4OFhacTV6c1l0QUMxeVpIZENLYTI2YVdkeTU2QTllSGoKTzFWeHp3bWJOeVhSZW5WdUJZUCswd3IzSFZLRkc0Sko0WlpwTlp6UVcvcHFFUGdoQ1RKSXZJdWVLNjUyQnlVYwovL3N2K25YZDVmMTlMZUVTOXBmMGwyNTNORGFGWlBiNmFlZ0tmcXVXaDhxbFFCbVVRMkd6YVRMYnRtTmQyOE02Clc3aUw3dGtLWmUxWm5CejlSS2d0UHJEampXR1pJbmpqY09VOEV0VDRTTHE3a0NWRG1QczVNRDh2YUFtOTZKc0UKam1MQzNVdS80azdIaURZWDBpMG1PV2tGalpRTWRWYXRjSUY1RlBTcHB3c1NiVzhRaWRuWHQ1NFV0d3RGREVQegpscGpzN3liZVFFNzFKWGNNWm5WSUs0YmpSWHNFRlBJOThScElsRWRlZGJTVWRZQW5jTE5KUlQ3SFpCTVBHU3daCjBQTkp1Z2xubHIzc3JWemRXMWR6MnhRamR2THd4eTZtTlVGNnJiUUJXQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K`
-//
-//const validCAPEMEncodeRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg==`
-//
-//const validIntermediateAndCertRSA = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQ0KTUlJRlZ6Q0NBeitnQXdJQkFnSUJBekFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUm93R0FZRFZRUUREQkZPYjNSaA0KY25rZ1ZHVnpkR2x1WnlCRFFURUxNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJseg0KWTI4eER6QU5CZ05WQkFvTUJrUnZZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdIaGNOTVRVd056RTJNRFF5TlRVdw0KV2hjTk1UWXdOekUxTURReU5UVXdXakJnTVJzd0dRWURWUVFEREJKelpXTjFjbVV1WlhoaGJYQnNaUzVqYjIweA0KQ3pBSkJnTlZCQVlUQWxWVE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRQ0KYjJOclpYSXhDekFKQmdOVkJBZ01Ba05CTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQw0KQVFFQW1MWWlZQ1RBV0pCV0F1eFpMcVZtVjRGaVVkR2dFcW9RdkNiTjczekYvbVFmaHEwQ0lUbzZ4U3hzMVFpRw0KRE96VXRrcHpYenppU2o0SjUrZXQ0SmtGbGVlRUthTWNIYWRlSXNTbEhHdlZ0WER2OTNvUjN5ZG1mWk8rVUxSVQ0KOHhIbG9xY0xyMUtyT1AxZGFMZmRNUmJhY3RkNzVVUWd2dzlYVHNkZU1WWDVBbGljU0VOVktWK0FRWHZWcHY4UA0KVDEwTVN2bEJGYW00cmVYdVkvU2tlTWJJYVc1cEZ1NkFRdjNabWZ0dDJ0YTBDQjlrYjFtWWQrT0tydThIbm5xNQ0KYUp3NlIzR2hQMFRCZDI1UDFQa2lTeE0yS0dZWlprMFcvTlpxTEs5L0xURktUTkN2N1ZqQ2J5c1ZvN0h4Q1kwYg0KUWUvYkRQODJ2N1NuTHRiM2Fab2dmdmE0SFFJREFRQUJvNElCR3pDQ0FSY3dnWWdHQTFVZEl3U0JnREIrZ0JSMw0KdVBJWEFYQUtkRzFGWlU4VjNrUU9LQk5lcWFGanBHRXdYekVMTUFrR0ExVUVCaE1DVlZNeEN6QUpCZ05WQkFnTQ0KQWtOQk1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRWIyTnJaWEl4R2pBWQ0KQmdOVkJBTU1FVTV2ZEdGeWVTQlVaWE4wYVc1bklFTkJnZ0VCTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwbA0KQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQTRHQTFVZER3RUIvd1FFQXdJRm9EQXVCZ05WSFJFRQ0KSnpBbGdoSnpaV04xY21VdVpYaGhiWEJzWlM1amIyMkNDV3h2WTJGc2FHOXpkSWNFZndBQUFUQWRCZ05WSFE0RQ0KRmdRVURQRDRDYVhSYnU1UUJiNWU4eThvZHZUcVc0SXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSk95bG1jNA0KbjdKNjRHS3NQL3hoVWRLS1Y5L0tEK3VmenBLYnJMSW9qV243clR5ZTcwdlkwT2pRRnVPWGM1NHlqTVNJTCsvNQ0KbWxOUTdZL2ZKUzh4ZEg3OUVSKzRuV011RDJlY2lMbnNMZ2JZVWs0aGl5Ynk4LzVWKy9ZcVBlQ3BQQ242VEpSSw0KYTBFNmxWL1VqWEpkcmlnSnZKb05PUjhaZ3RFWi9RUGdqSkVWVXNnNDdkdHF6c0RwZ2VTOGRjanVNV3BaeFAwMg0KcWF2RkxEalNGelZIKzJENk90eTFEUXBsbS8vM1hhUlhoMjNkT0NQOHdqL2J4dm5WVG9GV3Mrek80dVQxTEYvUw0KS1hDTlFvZWlHeFdIeXpyWEZWVnRWbkM5RlNOejBHZzIvRW0xdGZSZ3ZoVW40S0xKY3ZaVzlvMVI3VlZDWDBMMQ0KMHgwZnlLM1ZXZVdjODZhNWE2ODFhbUtaU0ViakFtSVZaRjl6T1gwUE9EQzhveSt6cU9QV2EwV0NsNEs2ekRDNg0KMklJRkJCTnk1MFpTMmlPTjZSWTZtRTdObUE3OGdja2Y0MTVjcUlWcmxvWUpiYlREZXBmaFRWMjE4U0xlcHBoNA0KdUdiMi9zeGtsZkhPWUUrcnBIY2lpYld3WHJ3bE9ESmFYdXpYRmhwbFVkL292ZHVqQk5BSUhrQmZ6eStZNnoycw0KYndaY2ZxRDROSWIvQUdoSXlXMnZidnU0enNsRHAxTUVzTG9hTytTemlyTXpreU1CbEtSdDEyMHR3czRFa1VsbQ0KL1FoalNVb1pwQ0FzeTVDL3BWNCtieDBTeXNOZC9TK2tLYVJaYy9VNlkzWllCRmhzekxoN0phTFhLbWs3d0huRQ0KcmdnbTZvejRML0d5UFdjL0ZqZm5zZWZXS00yeUMzUURoanZqDQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo=`
-//
-//const signedRSARootTemplate = `{"signed":{"_type":"Root","consistent_snapshot":false,"expires":"2016-07-16T23:34:13.389129622-07:00","keys":{"1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nIgzLigo5D47dWQe1IUjzHXxvyx0j/OL16VQymuloWsgVDxxT6+mH3CeviMAs+/McnEPE9exnm6SQGR5x3XMw=="}},"23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEClUFVWkc85OQScfTQRS02VaLIEaeCmxdwYS/hcTLVoTxlFfRfs7HyalTwXGAGO79XZZS+koE6s8D0xGcCJQkLQ=="}},"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292":{"keytype":"rsa-x509","keyval":{"private":null,"public":"{{.RootPem}}"}},"e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}},"roles":{"root":{"keyids":["49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292"],"threshold":1},"snapshot":{"keyids":["23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14"],"threshold":1},"targets":{"keyids":["1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670"],"threshold":1},"timestamp":{"keyids":["e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9"],"threshold":1}},"version":2},"signatures":[{"keyid":"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292","method":"rsapss","sig":"YlZwtCj028Xc23+KHfj6govFEY6hMbBXO5HT20F0I5ZeIPb1l7OmkjEiwp9ZHusClY+QeqiP1CFh\n/AfCbv4tLanqMkXPtm8UJJ1hMZVq86coieB32PQDj9k6x1hErHzvPUbOzTRW2BQkFFMZFkLDAd06\npH8lmxyPLOhdkVE8qIT7sBCy/4bQIGfvEX6yCDz84MZdcLNX5B9mzGi9A7gDloh9IEZxA8UgoI18\nSYpv/fYeSZSqM/ws2G+kiELGgTWhcZ+gOlF7ArM/DOlcC/NYqcvY1ugE6Gn7G8opre6NOofdRp3w\n603A2rMMvYTwqKLY6oX/d+07A2+WGHXPUy5otCAybWOw2hIZ35Jjmh12g6Dc6Qk4K2zXwAgvWwBU\nWlT8MlP1Tf7f80jnGjh0aARlHI4LCxlYU5L/pCaYuHgynujvLuzoOuiiPfJv7sYvKoQ8UieE1w//\nHc8E6tWtV5G2FguKLurMoKZ9FBWcanDO0fg5AWuG3qcgUJdvh9acQ33EKer1fqBxs6LSAUWo8rDt\nQkg+b55AW0YBukAW9IAfMySQGAS2e3mHZ8nK/ijaygCRu7/P+NgKY9/zpmfL2xgcNslLcANcSOOt\nhiJS6yqYM9i9G0af0yw/TxAT4ntwjVm8u52UyR/hXIiUc/mjZcYRbSmJOHws902+i+Z/qv72knk="}]}`
-//
-//func TestCertsToRemove(t *testing.T) {
-//	// Get a few certificates to test with
-//	cert1, err := trustmanager.LoadCertFromFile("../fixtures/secure.example.com.crt")
-//	assert.NoError(t, err)
-//	cert1KeyID, err := trustmanager.FingerprintCert(cert1)
-//	assert.NoError(t, err)
-//
-//	// Get intermediate certificate
-//	cert2, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_secure.example.com.crt")
-//	assert.NoError(t, err)
-//	cert2KeyID, err := trustmanager.FingerprintCert(cert2)
-//	assert.NoError(t, err)
-//
-//	// Get leaf certificate
-//	cert3, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_docker.com-notary.crt")
-//	assert.NoError(t, err)
-//	cert3KeyID, err := trustmanager.FingerprintCert(cert3)
-//	assert.NoError(t, err)
-//
-//	// Call CertsToRemove with only one old and one new
-//	oldCerts := []*x509.Certificate{cert1}
-//	newCerts := []*x509.Certificate{cert2}
-//
-//	certs := certsToRemove(oldCerts, newCerts)
-//	assert.Len(t, certs, 1)
-//	_, ok := certs[cert1KeyID]
-//	assert.True(t, ok)
-//
-//	// Call CertsToRemove with two old and one new
-//	oldCerts = []*x509.Certificate{cert1, cert2}
-//	newCerts = []*x509.Certificate{cert3}
-//
-//	certs = certsToRemove(oldCerts, newCerts)
-//	assert.Len(t, certs, 2)
-//	_, ok = certs[cert1KeyID]
-//	assert.True(t, ok)
-//	_, ok = certs[cert2KeyID]
-//	assert.True(t, ok)
-//	_, ok = certs[cert3KeyID]
-//	assert.False(t, ok)
-//
-//	// Call CertsToRemove with two new and one old
-//	oldCerts = []*x509.Certificate{cert3}
-//	newCerts = []*x509.Certificate{cert2, cert1}
-//
-//	certs = certsToRemove(oldCerts, newCerts)
-//	assert.Len(t, certs, 1)
-//	_, ok = certs[cert3KeyID]
-//	assert.True(t, ok)
-//	_, ok = certs[cert1KeyID]
-//	assert.False(t, ok)
-//	_, ok = certs[cert2KeyID]
-//	assert.False(t, ok)
-//
-//	// Call CertsToRemove with three old certs and no new
-//	oldCerts = []*x509.Certificate{cert1, cert2, cert3}
-//	newCerts = []*x509.Certificate{}
-//
-//	certs = certsToRemove(oldCerts, newCerts)
-//	assert.Len(t, certs, 0)
-//	_, ok = certs[cert1KeyID]
-//	assert.False(t, ok)
-//	_, ok = certs[cert2KeyID]
-//	assert.False(t, ok)
-//	_, ok = certs[cert3KeyID]
-//	assert.False(t, ok)
-//
-//	// Call CertsToRemove with three new certs and no old
-//	oldCerts = []*x509.Certificate{}
-//	newCerts = []*x509.Certificate{cert1, cert2, cert3}
-//
-//	certs = certsToRemove(oldCerts, newCerts)
-//	assert.Len(t, certs, 0)
-//	_, ok = certs[cert1KeyID]
-//	assert.False(t, ok)
-//	_, ok = certs[cert2KeyID]
-//	assert.False(t, ok)
-//	_, ok = certs[cert3KeyID]
-//	assert.False(t, ok)
-//
-//}
-//
-//func TestValidateRoot(t *testing.T) {
-//	var testSignedRoot data.Signed
-//	var signedRootBytes bytes.Buffer
-//
-//	// Temporary directory where test files will be created
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	defer os.RemoveAll(tempBaseDir)
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	keysPath := filepath.Join(tempBaseDir, PrivDir)
-//	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-//	assert.NoError(t, err)
-//
-//	// Create a FileStoreManager
-//	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
-//	assert.NoError(t, err)
-//
-//	// Execute our template
-//	templ, _ := template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validPEMEncodedRSARoot})
-//
-//	// Unmarshal our signedroot
-//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-//
-//	//
-//	// This call to ValidateRoot will succeed since we are using a valid PEM
-//	// encoded certificate, and have no other certificates for this CN
-//	//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-//	assert.NoError(t, err)
-//
-//	//
-//	// This call to ValidateRoot will fail since we are passing in a dnsName that
-//	// doesn't match the CN of the certificate.
-//	//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "diogomonica.com/notary")
-//	if assert.Error(t, err, "An error was expected") {
-//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-//	}
-//
-//	//
-//	// This call to ValidateRoot will fail since we are passing an unparsable RootSigned
-//	//
-//	// Execute our template deleting the old buffer first
-//	signedRootBytes.Reset()
-//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "------ ABSOLUTELY NOT A PEM -------"})
-//	// Unmarshal our signedroot
-//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-//	assert.Error(t, err, "illegal base64 data at input byte")
-//
-//	//
-//	// This call to ValidateRoot will fail since we are passing an invalid PEM cert
-//	//
-//	// Execute our template deleting the old buffer first
-//	signedRootBytes.Reset()
-//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "LS0tLS1CRUdJTiBDRVJU"})
-//	// Unmarshal our signedroot
-//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-//	if assert.Error(t, err, "An error was expected") {
-//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-//	}
-//
-//	//
-//	// This call to ValidateRoot will fail since we are passing only CA certificate
-//	// This will fail due to the lack of a leaf certificate
-//	//
-//	// Execute our template deleting the old buffer first
-//	signedRootBytes.Reset()
-//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validCAPEMEncodeRSARoot})
-//	// Unmarshal our signedroot
-//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
-//	if assert.Error(t, err, "An error was expected") {
-//		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
-//	}
-//
-//	//
-//	// This call to ValidateRoot will suceed in getting to the TUF validation, since
-//	// we are using a valid PEM encoded certificate chain of intermediate + leaf cert
-//	// that are signed by a trusted root authority and the leaf cert has a correct CN.
-//	// It will, however, fail to validate, because it has an invalid TUF signature
-//	//
-//	// Execute our template deleting the old buffer first
-//	signedRootBytes.Reset()
-//	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
-//	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validIntermediateAndCertRSA})
-//
-//	// Unmarshal our signedroot
-//	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
-//
-//	err = keyStoreManager.ValidateRoot(&testSignedRoot, "secure.example.com")
-//	if assert.Error(t, err, "An error was expected") {
-//		assert.Equal(t, err, &ErrValidationFail{Reason: "failed to validate integrity of roots"})
-//	}
-//}
-//
-//// TestValidateSuccessfulRootRotation runs through a full root certificate rotation
-//// We test this with both an RSA and ECDSA root certificate
-//func TestValidateSuccessfulRootRotation(t *testing.T) {
-//	testValidateSuccessfulRootRotation(t, data.ECDSAKey, data.ECDSAx509Key)
-//	if !testing.Short() {
-//		testValidateSuccessfulRootRotation(t, data.RSAKey, data.RSAx509Key)
-//	}
-//}
-//
-//// Generates a KeyStoreManager in a temporary directory and returns the
-//// manager and certificates for two keys which have been added to the keystore.
-//// Also returns the temporary directory so it can be cleaned up.
-//func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
-//	string, *KeyStoreManager, []*x509.Certificate) {
-//	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
-//	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
-//
-//	keysPath := filepath.Join(tempBaseDir, PrivDir)
-//	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
-//	assert.NoError(t, err)
-//
-//	// Create a FileStoreManager
-//	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
-//	assert.NoError(t, err)
-//
-//	certs := make([]*x509.Certificate, 2)
-//	for i := 0; i < 2; i++ {
-//		keyID, err := keyStoreManager.GenRootKey(keyAlg)
-//		assert.NoError(t, err)
-//
-//		key, _, err := keyStoreManager.KeyStore.GetKey(keyID)
-//		assert.NoError(t, err)
-//
-//		cert, err := cryptoservice.GenerateCertificate(key, gun)
-//		assert.NoError(t, err)
-//
-//		certs[i] = cert
-//	}
-//	return tempBaseDir, keyStoreManager, certs
-//}
-//
-//func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string) {
-//	// The gun to test
-//	gun := "docker.com/notary"
-//
-//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-//	defer os.RemoveAll(tempBaseDir)
-//	origRootCert := certs[0]
-//	replRootCert := certs[1]
-//
-//	// Add the old root cert part of trustedCertificates
-//	keyStoreManager.AddTrustedCert(origRootCert)
-//
-//	// We need the PEM representation of the replacement key to put it into the TUF data
-//	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
-//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-//
-//	// Tuf key with PEM-encoded x509 certificate
-//	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
-//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-//
-//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-//	assert.NoError(t, err)
-//
-//	testRoot, err := data.NewRoot(
-//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-//		map[string]*data.RootRole{"root": &rootRole.RootRole},
-//		false,
-//	)
-//	assert.NoError(t, err, "Failed to create new root")
-//
-//	signedTestRoot, err := testRoot.ToSigned()
-//	assert.NoError(t, err)
-//
-//	cs := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
-//
-//	err = signed.Sign(cs, signedTestRoot, replRootKey)
-//	assert.NoError(t, err)
-//
-//	err = signed.Sign(cs, signedTestRoot, origRootKey)
-//	assert.NoError(t, err)
-//
-//	//
-//	// This call to ValidateRoot will succeed since we are using a valid PEM
-//	// encoded certificate, and have no other certificates for this CN
-//	//
-//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-//	assert.NoError(t, err)
-//
-//	// Finally, validate the only trusted certificate that exists is the new one
-//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-//	assert.Len(t, certs, 1)
-//	assert.Equal(t, certs[0], replRootCert)
-//}
-//
-//// TestValidateRootRotationMissingOrigSig runs through a full root certificate rotation
-//// where we are missing the original root key signature. Verification should fail.
-//// We test this with both an RSA and ECDSA root certificate
-//func TestValidateRootRotationMissingOrigSig(t *testing.T) {
-//	testValidateRootRotationMissingOrigSig(t, data.ECDSAKey, data.ECDSAx509Key)
-//	if !testing.Short() {
-//		testValidateRootRotationMissingOrigSig(t, data.RSAKey, data.RSAx509Key)
-//	}
-//}
-//
-//func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType string) {
-//	gun := "docker.com/notary"
-//
-//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-//	defer os.RemoveAll(tempBaseDir)
-//	origRootCert := certs[0]
-//	replRootCert := certs[1]
-//
-//	// Add the old root cert part of trustedCertificates
-//	keyStoreManager.AddTrustedCert(origRootCert)
-//
-//	// We need the PEM representation of the replacement key to put it into the TUF data
-//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-//
-//	// Tuf key with PEM-encoded x509 certificate
-//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-//
-//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-//	assert.NoError(t, err)
-//
-//	testRoot, err := data.NewRoot(
-//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-//		map[string]*data.RootRole{"root": &rootRole.RootRole},
-//		false,
-//	)
-//	assert.NoError(t, err, "Failed to create new root")
-//
-//	signedTestRoot, err := testRoot.ToSigned()
-//	assert.NoError(t, err)
-//
-//	// We only sign with the new key, and not with the original one.
-//	err = signed.Sign(
-//		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
-//		signedTestRoot, replRootKey)
-//	assert.NoError(t, err)
-//
-//	//
-//	// This call to ValidateRoot will succeed since we are using a valid PEM
-//	// encoded certificate, and have no other certificates for this CN
-//	//
-//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-//	assert.Error(t, err, "insuficient signatures on root")
-//
-//	// Finally, validate the only trusted certificate that exists is still
-//	// the old one
-//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-//	assert.Len(t, certs, 1)
-//	assert.Equal(t, certs[0], origRootCert)
-//}
-//
-//// TestValidateRootRotationMissingNewSig runs through a full root certificate rotation
-//// where we are missing the new root key signature. Verification should fail.
-//// We test this with both an RSA and ECDSA root certificate
-//func TestValidateRootRotationMissingNewSig(t *testing.T) {
-//	testValidateRootRotationMissingNewSig(t, data.ECDSAKey, data.ECDSAx509Key)
-//	if !testing.Short() {
-//		testValidateRootRotationMissingNewSig(t, data.RSAKey, data.RSAx509Key)
-//	}
-//}
-//
-//func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType string) {
-//	gun := "docker.com/notary"
-//
-//	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
-//	defer os.RemoveAll(tempBaseDir)
-//	origRootCert := certs[0]
-//	replRootCert := certs[1]
-//
-//	// Add the old root cert part of trustedCertificates
-//	keyStoreManager.AddTrustedCert(origRootCert)
-//
-//	// We need the PEM representation of the replacement key to put it into the TUF data
-//	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
-//	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
-//
-//	// Tuf key with PEM-encoded x509 certificate
-//	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
-//	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
-//
-//	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
-//	assert.NoError(t, err)
-//
-//	testRoot, err := data.NewRoot(
-//		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
-//		map[string]*data.RootRole{"root": &rootRole.RootRole},
-//		false,
-//	)
-//	assert.NoError(t, err, "Failed to create new root")
-//
-//	signedTestRoot, err := testRoot.ToSigned()
-//	assert.NoError(t, err)
-//
-//	// We only sign with the old key, and not with the new one
-//	err = signed.Sign(
-//		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
-//		signedTestRoot, origRootKey)
-//	assert.NoError(t, err)
-//
-//	//
-//	// This call to ValidateRoot will succeed since we are using a valid PEM
-//	// encoded certificate, and have no other certificates for this CN
-//	//
-//	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
-//	assert.Error(t, err, "insuficient signatures on root")
-//
-//	// Finally, validate the only trusted certificate that exists is still
-//	// the old one
-//	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
-//	assert.Len(t, certs, 1)
-//	assert.Equal(t, certs[0], origRootCert)
-//}
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/json"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+	"text/template"
+
+	"github.com/docker/notary"
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/tuf/data"
+	"github.com/docker/notary/tuf/signed"
+	"github.com/stretchr/testify/assert"
+)
+
+type SignedRSARootTemplate struct {
+	RootPem string
+}
+
+var passphraseRetriever = func(string, string, bool, int) (string, bool, error) { return "passphrase", false, nil }
+
+const validPEMEncodedRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZLekNDQXhXZ0F3SUJBZ0lRUnlwOVFxY0pmZDNheXFkaml6OHhJREFMQmdrcWhraUc5dzBCQVFzd09ERWEKTUJnR0ExVUVDaE1SWkc5amEyVnlMbU52YlM5dWIzUmhjbmt4R2pBWUJnTlZCQU1URVdSdlkydGxjaTVqYjIwdgpibTkwWVhKNU1CNFhEVEUxTURjeE56QTJNelF5TTFvWERURTNNRGN4TmpBMk16UXlNMW93T0RFYU1CZ0dBMVVFCkNoTVJaRzlqYTJWeUxtTnZiUzl1YjNSaGNua3hHakFZQmdOVkJBTVRFV1J2WTJ0bGNpNWpiMjB2Ym05MFlYSjUKTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUFvUWZmcnpzWW5zSDh2R2Y0Smg1NQpDajV3cmpVR3pEL3NIa2FGSHB0ako2VG9KR0p2NXlNQVB4enlJbnU1c0lvR0xKYXBuWVZCb0FVMFlnSTlxbEFjCllBNlN4YVN3Z202cnB2bW5sOFFuMHFjNmdlcjNpbnBHYVVKeWxXSHVQd1drdmNpbVFBcUhaeDJkUXRMN2c2a3AKcm1LZVRXcFdvV0x3M0pvQVVaVVZoWk1kNmEyMlpML0R2QXcrSHJvZ2J6NFhleWFoRmI5SUg0MDJ6UHhONnZnYQpKRUZURjBKaTFqdE5nME1vNHBiOVNIc01zaXcrTFpLN1NmZkhWS1B4dmQyMW0vYmlObXdzZ0V4QTNVOE9PRzhwCnV5Z2ZhY3lzNWM4K1pyWCtaRkcvY3Z3S3owazYvUWZKVTQwczZNaFh3NUMyV3R0ZFZtc0c5LzdyR0ZZakhvSUoKd2VEeXhnV2s3dnhLelJKSS91bjdjYWdESWFRc0tySlFjQ0hJR0ZSbHBJUjVUd1g3dmwzUjdjUm5jckRSTVZ2YwpWU0VHMmVzeGJ3N2p0eklwL3lwblZSeGNPbnk3SXlweWpLcVZlcVo2SGd4WnRUQlZyRjFPL2FIbzJrdmx3eVJTCkF1czRrdmg2ejMranpUbTlFemZYaVBRelk5QkVrNWdPTHhoVzlyYzZVaGxTK3BlNWxrYU4vSHlxeS9sUHVxODkKZk1yMnJyN2xmNVdGZEZuemU2V05ZTUFhVzdkTkE0TkUwZHlENTM0MjhaTFh4TlZQTDRXVTY2R2FjNmx5blE4bApyNXRQc1lJRlh6aDZGVmFSS0dRVXRXMWh6OWVjTzZZMjdSaDJKc3lpSXhnVXFrMm9veEU2OXVONDJ0K2R0cUtDCjFzOEcvN1Z0WThHREFMRkxZVG56THZzQ0F3RUFBYU0xTURNd0RnWURWUjBQQVFIL0JBUURBZ0NnTUJNR0ExVWQKSlFRTU1Bb0dDQ3NHQVFVRkJ3TURNQXdHQTFVZEV3RUIvd1FDTUFBd0N3WUpLb1pJaHZjTkFRRUxBNElDQVFCTQpPbGwzRy9YQno4aWRpTmROSkRXVWgrNXczb2ptd2FuclRCZENkcUVrMVdlbmFSNkR0Y2ZsSng2WjNmL213VjRvCmIxc2tPQVgxeVg1UkNhaEpIVU14TWljei9RMzhwT1ZlbEdQclduYzNUSkIrVktqR3lIWGxRRFZrWkZiKzQrZWYKd3RqN0huZ1hoSEZGRFNnam0zRWRNbmR2Z0RRN1NRYjRza09uQ05TOWl5WDdlWHhoRkJDWm1aTCtIQUxLQmoyQgp5aFY0SWNCRHFtcDUwNHQxNHJ4OS9KdnR5MGRHN2ZZN0k1MWdFUXBtNFMwMkpNTDV4dlRtMXhmYm9XSWhaT0RJCnN3RUFPK2VrQm9GSGJTMVE5S01QaklBdzNUckNISDh4OFhacTV6c1l0QUMxeVpIZENLYTI2YVdkeTU2QTllSGoKTzFWeHp3bWJOeVhSZW5WdUJZUCswd3IzSFZLRkc0Sko0WlpwTlp6UVcvcHFFUGdoQ1RKSXZJdWVLNjUyQnlVYwovL3N2K25YZDVmMTlMZUVTOXBmMGwyNTNORGFGWlBiNmFlZ0tmcXVXaDhxbFFCbVVRMkd6YVRMYnRtTmQyOE02Clc3aUw3dGtLWmUxWm5CejlSS2d0UHJEampXR1pJbmpqY09VOEV0VDRTTHE3a0NWRG1QczVNRDh2YUFtOTZKc0UKam1MQzNVdS80azdIaURZWDBpMG1PV2tGalpRTWRWYXRjSUY1RlBTcHB3c1NiVzhRaWRuWHQ1NFV0d3RGREVQegpscGpzN3liZVFFNzFKWGNNWm5WSUs0YmpSWHNFRlBJOThScElsRWRlZGJTVWRZQW5jTE5KUlQ3SFpCTVBHU3daCjBQTkp1Z2xubHIzc3JWemRXMWR6MnhRamR2THd4eTZtTlVGNnJiUUJXQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K`
+
+const validCAPEMEncodeRSARoot = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg==`
+
+const validIntermediateAndCertRSA = `LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlHTXpDQ0JCdWdBd0lCQWdJQkFUQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SlZVekVMDQpNQWtHQTFVRUNBd0NRMEV4RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFYU1CZ0dBMVVFQXd3UlRtOTBZWEo1SUZSbGMzUnBibWNnUTBFd0hoY05NVFV3TnpFMk1EUXlOVEF6DQpXaGNOTWpVd056RXpNRFF5TlRBeldqQmZNUm93R0FZRFZRUUREQkZPYjNSaGNua2dWR1Z6ZEdsdVp5QkRRVEVMDQpNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJselkyOHhEekFOQmdOVkJBb01Ca1J2DQpZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDDQpBUUN3VlZENHBLN3o3cFhQcEpiYVoxSGc1ZVJYSWNhWXRiRlBDbk4waXF5OUhzVkVHbkVuNUJQTlNFc3VQK20wDQo1TjBxVlY3REdiMVNqaWxvTFhEMXFERHZoWFdrK2dpUzlwcHFQSFBMVlBCNGJ2enNxd0RZcnRwYnFrWXZPMFlLDQowU0wza3hQWFVGZGxrRmZndTB4amxjem0yUGhXRzNKZDhhQXRzcEwvTCtWZlBBMTNKVWFXeFNMcHVpMUluOHJoDQpnQXlRVEs2UTRPZjZHYkpZVG5BSGI1OVVvTFhTekI1QWZxaVVxNkw3bkVZWUtvUGZsUGJSQUlXTC9VQm0wYytIDQpvY21zNzA2UFlwbVBTMlJRdjNpT0dtbm45aEVWcDNQNmpxN1dBZXZiQTRhWUd4NUVzYlZ0WUFCcUpCYkZXQXV3DQp3VEdSWW16bjBNajBlVE1nZTl6dFlCMi8yc3hkVGU2dWhtRmdwVVhuZ0RxSkk1TzlOM3pQZnZsRUltQ2t5M0hNDQpqSm9MN2c1c21xWDlvMVArRVNMaDBWWnpoaDdJRFB6UVRYcGNQSVMvNnowbDIyUUdrSy8xTjFQYUFEYVVIZExMDQp2U2F2M3kyQmFFbVB2ZjJma1pqOHlQNWVZZ2k3Q3c1T05oSExEWUhGY2w5Wm0veXdtZHhISkVUejluZmdYbnNXDQpITnhEcXJrQ1ZPNDZyL3U2clNyVXQ2aHIzb2RkSkc4czhKbzA2ZWFydzZYVTNNek0rM2dpd2tLMFNTTTN1UlBxDQo0QXNjUjFUditFMzFBdU9BbWpxWVFvVDI5Yk1JeG9TemVsamovWW5lZHdqVzQ1cFd5YzNKb0hhaWJEd3ZXOVVvDQpHU1pCVnk0aHJNL0ZhN1hDV3YxV2ZITlcxZ0R3YUxZd0RubDVqRm1SQnZjZnVRSURBUUFCbzRINU1JSDJNSUdSDQpCZ05WSFNNRWdZa3dnWWFBRkhVTTFVM0U0V3lMMW52RmQrZFBZOGY0TzJoWm9XT2tZVEJmTVFzd0NRWURWUVFHDQpFd0pWVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhGakFVQmdOVkJBY01EVk5oYmlCR2NtRnVZMmx6WTI4eER6QU5CZ05WDQpCQW9NQmtSdlkydGxjakVhTUJnR0ExVUVBd3dSVG05MFlYSjVJRlJsYzNScGJtY2dRMEdDQ1FEQ2VETGJlbUlUDQpTekFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VBTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQ0JnZ3JCZ0VGDQpCUWNEQVRBT0JnTlZIUThCQWY4RUJBTUNBVVl3SFFZRFZSME9CQllFRkhlNDhoY0JjQXAwYlVWbFR4WGVSQTRvDQpFMTZwTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFBV1V0QVBkVUZwd1JxK04xU3pHVWVqU2lrZU1HeVBac2NaDQpKQlVDbWhab0Z1ZmdYR2JMTzVPcGNSTGFWM1hkYTB0LzVQdGRHTVNFemN6ZW9aSFdrbkR0dys3OU9CaXR0UFBqDQpTaDFvRkR1UG8zNVI3ZVA2MjRsVUNjaC9JblpDcGhUYUx4OW9ETEdjYUszYWlsUTl3akJkS2RsQmw4S05LSVpwDQphMTNhUDVyblNtMkp2YSt0WHkveWkzQlNkczNkR0Q4SVRLWnlJLzZBRkh4R3ZPYnJESUJwbzRGRi96Y1dYVkRqDQpwYU9teHBsUnRNNEhpdG0rc1hHdmZxSmU0eDVEdU9YT25QclQzZEh2UlQ2dlNaVW9Lb2J4TXFtUlRPY3JPSVBhDQpFZU1wT29ic2hPUnVSbnRNRFl2dmdPM0Q2cDZpY2lEVzJWcDlONnJkTWRmT1dFUU44SlZXdkI3SXhSSGs5cUtKDQp2WU9XVmJjekF0MHFwTXZYRjNQWExqWmJVTTBrbk9kVUtJRWJxUDRZVWJnZHp4NlJ0Z2lpWTkzMEFqNnRBdGNlDQowZnBnTmx2ak1ScFNCdVdUbEFmTk5qRy9ZaG5kTXo5dUk2OFRNZkZwUjNQY2dWSXYzMGtydy85VnpvTGkyRHBlDQpvdzZEckdPNm9pK0RoTjc4UDRqWS9POVVjelpLMnJvWkwxT2k1UDBSSXhmMjNVWkM3eDFEbGNOM25CcjRzWVN2DQpyQng0Y0ZUTU5wd1UrbnpzSWk0ZGpjRkRLbUpkRU95ak1ua1AydjBMd2U3eXZLMDhwWmRFdSswemJycTE3a3VlDQpYcFhMYzdLNjhRQjE1eXh6R3lsVTVyUnd6bUMvWXNBVnlFNGVvR3U4UHhXeHJFUnZIYnk0QjhZUDB2QWZPcmFMDQpsS21YbEs0ZFRnPT0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQ0KTUlJRlZ6Q0NBeitnQXdJQkFnSUJBekFOQmdrcWhraUc5dzBCQVFzRkFEQmZNUm93R0FZRFZRUUREQkZPYjNSaA0KY25rZ1ZHVnpkR2x1WnlCRFFURUxNQWtHQTFVRUJoTUNWVk14RmpBVUJnTlZCQWNNRFZOaGJpQkdjbUZ1WTJseg0KWTI4eER6QU5CZ05WQkFvTUJrUnZZMnRsY2pFTE1Ba0dBMVVFQ0F3Q1EwRXdIaGNOTVRVd056RTJNRFF5TlRVdw0KV2hjTk1UWXdOekUxTURReU5UVXdXakJnTVJzd0dRWURWUVFEREJKelpXTjFjbVV1WlhoaGJYQnNaUzVqYjIweA0KQ3pBSkJnTlZCQVlUQWxWVE1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRQ0KYjJOclpYSXhDekFKQmdOVkJBZ01Ba05CTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQw0KQVFFQW1MWWlZQ1RBV0pCV0F1eFpMcVZtVjRGaVVkR2dFcW9RdkNiTjczekYvbVFmaHEwQ0lUbzZ4U3hzMVFpRw0KRE96VXRrcHpYenppU2o0SjUrZXQ0SmtGbGVlRUthTWNIYWRlSXNTbEhHdlZ0WER2OTNvUjN5ZG1mWk8rVUxSVQ0KOHhIbG9xY0xyMUtyT1AxZGFMZmRNUmJhY3RkNzVVUWd2dzlYVHNkZU1WWDVBbGljU0VOVktWK0FRWHZWcHY4UA0KVDEwTVN2bEJGYW00cmVYdVkvU2tlTWJJYVc1cEZ1NkFRdjNabWZ0dDJ0YTBDQjlrYjFtWWQrT0tydThIbm5xNQ0KYUp3NlIzR2hQMFRCZDI1UDFQa2lTeE0yS0dZWlprMFcvTlpxTEs5L0xURktUTkN2N1ZqQ2J5c1ZvN0h4Q1kwYg0KUWUvYkRQODJ2N1NuTHRiM2Fab2dmdmE0SFFJREFRQUJvNElCR3pDQ0FSY3dnWWdHQTFVZEl3U0JnREIrZ0JSMw0KdVBJWEFYQUtkRzFGWlU4VjNrUU9LQk5lcWFGanBHRXdYekVMTUFrR0ExVUVCaE1DVlZNeEN6QUpCZ05WQkFnTQ0KQWtOQk1SWXdGQVlEVlFRSERBMVRZVzRnUm5KaGJtTnBjMk52TVE4d0RRWURWUVFLREFaRWIyTnJaWEl4R2pBWQ0KQmdOVkJBTU1FVTV2ZEdGeWVTQlVaWE4wYVc1bklFTkJnZ0VCTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwbA0KQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQTRHQTFVZER3RUIvd1FFQXdJRm9EQXVCZ05WSFJFRQ0KSnpBbGdoSnpaV04xY21VdVpYaGhiWEJzWlM1amIyMkNDV3h2WTJGc2FHOXpkSWNFZndBQUFUQWRCZ05WSFE0RQ0KRmdRVURQRDRDYVhSYnU1UUJiNWU4eThvZHZUcVc0SXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSk95bG1jNA0KbjdKNjRHS3NQL3hoVWRLS1Y5L0tEK3VmenBLYnJMSW9qV243clR5ZTcwdlkwT2pRRnVPWGM1NHlqTVNJTCsvNQ0KbWxOUTdZL2ZKUzh4ZEg3OUVSKzRuV011RDJlY2lMbnNMZ2JZVWs0aGl5Ynk4LzVWKy9ZcVBlQ3BQQ242VEpSSw0KYTBFNmxWL1VqWEpkcmlnSnZKb05PUjhaZ3RFWi9RUGdqSkVWVXNnNDdkdHF6c0RwZ2VTOGRjanVNV3BaeFAwMg0KcWF2RkxEalNGelZIKzJENk90eTFEUXBsbS8vM1hhUlhoMjNkT0NQOHdqL2J4dm5WVG9GV3Mrek80dVQxTEYvUw0KS1hDTlFvZWlHeFdIeXpyWEZWVnRWbkM5RlNOejBHZzIvRW0xdGZSZ3ZoVW40S0xKY3ZaVzlvMVI3VlZDWDBMMQ0KMHgwZnlLM1ZXZVdjODZhNWE2ODFhbUtaU0ViakFtSVZaRjl6T1gwUE9EQzhveSt6cU9QV2EwV0NsNEs2ekRDNg0KMklJRkJCTnk1MFpTMmlPTjZSWTZtRTdObUE3OGdja2Y0MTVjcUlWcmxvWUpiYlREZXBmaFRWMjE4U0xlcHBoNA0KdUdiMi9zeGtsZkhPWUUrcnBIY2lpYld3WHJ3bE9ESmFYdXpYRmhwbFVkL292ZHVqQk5BSUhrQmZ6eStZNnoycw0KYndaY2ZxRDROSWIvQUdoSXlXMnZidnU0enNsRHAxTUVzTG9hTytTemlyTXpreU1CbEtSdDEyMHR3czRFa1VsbQ0KL1FoalNVb1pwQ0FzeTVDL3BWNCtieDBTeXNOZC9TK2tLYVJaYy9VNlkzWllCRmhzekxoN0phTFhLbWs3d0huRQ0KcmdnbTZvejRML0d5UFdjL0ZqZm5zZWZXS00yeUMzUURoanZqDQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tDQo=`
+
+const signedRSARootTemplate = `{"signed":{"_type":"Root","consistent_snapshot":false,"expires":"2016-07-16T23:34:13.389129622-07:00","keys":{"1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nIgzLigo5D47dWQe1IUjzHXxvyx0j/OL16VQymuloWsgVDxxT6+mH3CeviMAs+/McnEPE9exnm6SQGR5x3XMw=="}},"23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEClUFVWkc85OQScfTQRS02VaLIEaeCmxdwYS/hcTLVoTxlFfRfs7HyalTwXGAGO79XZZS+koE6s8D0xGcCJQkLQ=="}},"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292":{"keytype":"rsa-x509","keyval":{"private":null,"public":"{{.RootPem}}"}},"e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9":{"keytype":"ecdsa","keyval":{"private":null,"public":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgl3rzMPMEKhS1k/AX16MM4PdidpjJr+z4pj0Td+30QnpbOIARgpyR1PiFztU8BZlqG3cUazvFclr2q/xHvfrqw=="}}},"roles":{"root":{"keyids":["49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292"],"threshold":1},"snapshot":{"keyids":["23c29cc372109c819e081bc953b7657d05e3f968f03c21d0d75ea457590f3d14"],"threshold":1},"targets":{"keyids":["1fc4fdc38f66558658c5c59b67f1716bdc6a74ef138b023ae5931db69f51d670"],"threshold":1},"timestamp":{"keyids":["e3a5a4fdaf11ea1ec58f5efed6f3639b39cd4cfa1418c8b55c9a8c2447ace5d9"],"threshold":1}},"version":2},"signatures":[{"keyid":"49cf5c6404a35fa41d5a5aa2ce539dfee0d7a2176d0da488914a38603b1f4292","method":"rsapss","sig":"YlZwtCj028Xc23+KHfj6govFEY6hMbBXO5HT20F0I5ZeIPb1l7OmkjEiwp9ZHusClY+QeqiP1CFh\n/AfCbv4tLanqMkXPtm8UJJ1hMZVq86coieB32PQDj9k6x1hErHzvPUbOzTRW2BQkFFMZFkLDAd06\npH8lmxyPLOhdkVE8qIT7sBCy/4bQIGfvEX6yCDz84MZdcLNX5B9mzGi9A7gDloh9IEZxA8UgoI18\nSYpv/fYeSZSqM/ws2G+kiELGgTWhcZ+gOlF7ArM/DOlcC/NYqcvY1ugE6Gn7G8opre6NOofdRp3w\n603A2rMMvYTwqKLY6oX/d+07A2+WGHXPUy5otCAybWOw2hIZ35Jjmh12g6Dc6Qk4K2zXwAgvWwBU\nWlT8MlP1Tf7f80jnGjh0aARlHI4LCxlYU5L/pCaYuHgynujvLuzoOuiiPfJv7sYvKoQ8UieE1w//\nHc8E6tWtV5G2FguKLurMoKZ9FBWcanDO0fg5AWuG3qcgUJdvh9acQ33EKer1fqBxs6LSAUWo8rDt\nQkg+b55AW0YBukAW9IAfMySQGAS2e3mHZ8nK/ijaygCRu7/P+NgKY9/zpmfL2xgcNslLcANcSOOt\nhiJS6yqYM9i9G0af0yw/TxAT4ntwjVm8u52UyR/hXIiUc/mjZcYRbSmJOHws902+i+Z/qv72knk="}]}`
+
+func TestCertsToRemove(t *testing.T) {
+	// Get a few certificates to test with
+	cert1, err := trustmanager.LoadCertFromFile("../fixtures/secure.example.com.crt")
+	assert.NoError(t, err)
+	cert1KeyID, err := trustmanager.FingerprintCert(cert1)
+	assert.NoError(t, err)
+
+	// Get intermediate certificate
+	cert2, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_secure.example.com.crt")
+	assert.NoError(t, err)
+	cert2KeyID, err := trustmanager.FingerprintCert(cert2)
+	assert.NoError(t, err)
+
+	// Get leaf certificate
+	cert3, err := trustmanager.LoadCertFromFile("../fixtures/self-signed_docker.com-notary.crt")
+	assert.NoError(t, err)
+	cert3KeyID, err := trustmanager.FingerprintCert(cert3)
+	assert.NoError(t, err)
+
+	// Call CertsToRemove with only one old and one new
+	oldCerts := []*x509.Certificate{cert1}
+	newCerts := []*x509.Certificate{cert2}
+
+	certs := certsToRemove(oldCerts, newCerts)
+	assert.Len(t, certs, 1)
+	_, ok := certs[cert1KeyID]
+	assert.True(t, ok)
+
+	// Call CertsToRemove with two old and one new
+	oldCerts = []*x509.Certificate{cert1, cert2}
+	newCerts = []*x509.Certificate{cert3}
+
+	certs = certsToRemove(oldCerts, newCerts)
+	assert.Len(t, certs, 2)
+	_, ok = certs[cert1KeyID]
+	assert.True(t, ok)
+	_, ok = certs[cert2KeyID]
+	assert.True(t, ok)
+	_, ok = certs[cert3KeyID]
+	assert.False(t, ok)
+
+	// Call CertsToRemove with two new and one old
+	oldCerts = []*x509.Certificate{cert3}
+	newCerts = []*x509.Certificate{cert2, cert1}
+
+	certs = certsToRemove(oldCerts, newCerts)
+	assert.Len(t, certs, 1)
+	_, ok = certs[cert3KeyID]
+	assert.True(t, ok)
+	_, ok = certs[cert1KeyID]
+	assert.False(t, ok)
+	_, ok = certs[cert2KeyID]
+	assert.False(t, ok)
+
+	// Call CertsToRemove with three old certs and no new
+	oldCerts = []*x509.Certificate{cert1, cert2, cert3}
+	newCerts = []*x509.Certificate{}
+
+	certs = certsToRemove(oldCerts, newCerts)
+	assert.Len(t, certs, 0)
+	_, ok = certs[cert1KeyID]
+	assert.False(t, ok)
+	_, ok = certs[cert2KeyID]
+	assert.False(t, ok)
+	_, ok = certs[cert3KeyID]
+	assert.False(t, ok)
+
+	// Call CertsToRemove with three new certs and no old
+	oldCerts = []*x509.Certificate{}
+	newCerts = []*x509.Certificate{cert1, cert2, cert3}
+
+	certs = certsToRemove(oldCerts, newCerts)
+	assert.Len(t, certs, 0)
+	_, ok = certs[cert1KeyID]
+	assert.False(t, ok)
+	_, ok = certs[cert2KeyID]
+	assert.False(t, ok)
+	_, ok = certs[cert3KeyID]
+	assert.False(t, ok)
+
+}
+
+func TestValidateRoot(t *testing.T) {
+	var testSignedRoot data.Signed
+	var signedRootBytes bytes.Buffer
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	defer os.RemoveAll(tempBaseDir)
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	keysPath := filepath.Join(tempBaseDir, notary.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	assert.NoError(t, err)
+
+	// Create a FileStoreManager
+	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
+	assert.NoError(t, err)
+
+	// Execute our template
+	templ, _ := template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validPEMEncodedRSARoot})
+
+	// Unmarshal our signedroot
+	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+
+	//
+	// This call to ValidateRoot will succeed since we are using a valid PEM
+	// encoded certificate, and have no other certificates for this CN
+	//
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+	assert.NoError(t, err)
+
+	//
+	// This call to ValidateRoot will fail since we are passing in a dnsName that
+	// doesn't match the CN of the certificate.
+	//
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "diogomonica.com/notary")
+	if assert.Error(t, err, "An error was expected") {
+		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+	}
+
+	//
+	// This call to ValidateRoot will fail since we are passing an unparsable RootSigned
+	//
+	// Execute our template deleting the old buffer first
+	signedRootBytes.Reset()
+	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "------ ABSOLUTELY NOT A PEM -------"})
+	// Unmarshal our signedroot
+	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+	assert.Error(t, err, "illegal base64 data at input byte")
+
+	//
+	// This call to ValidateRoot will fail since we are passing an invalid PEM cert
+	//
+	// Execute our template deleting the old buffer first
+	signedRootBytes.Reset()
+	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: "LS0tLS1CRUdJTiBDRVJU"})
+	// Unmarshal our signedroot
+	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+	if assert.Error(t, err, "An error was expected") {
+		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+	}
+
+	//
+	// This call to ValidateRoot will fail since we are passing only CA certificate
+	// This will fail due to the lack of a leaf certificate
+	//
+	// Execute our template deleting the old buffer first
+	signedRootBytes.Reset()
+	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validCAPEMEncodeRSARoot})
+	// Unmarshal our signedroot
+	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "docker.com/notary")
+	if assert.Error(t, err, "An error was expected") {
+		assert.Equal(t, err, &ErrValidationFail{Reason: "unable to retrieve valid leaf certificates"})
+	}
+
+	//
+	// This call to ValidateRoot will suceed in getting to the TUF validation, since
+	// we are using a valid PEM encoded certificate chain of intermediate + leaf cert
+	// that are signed by a trusted root authority and the leaf cert has a correct CN.
+	// It will, however, fail to validate, because it has an invalid TUF signature
+	//
+	// Execute our template deleting the old buffer first
+	signedRootBytes.Reset()
+	templ, _ = template.New("SignedRSARootTemplate").Parse(signedRSARootTemplate)
+	templ.Execute(&signedRootBytes, SignedRSARootTemplate{RootPem: validIntermediateAndCertRSA})
+
+	// Unmarshal our signedroot
+	json.Unmarshal(signedRootBytes.Bytes(), &testSignedRoot)
+
+	err = keyStoreManager.ValidateRoot(&testSignedRoot, "secure.example.com")
+	if assert.Error(t, err, "An error was expected") {
+		assert.Equal(t, err, &ErrValidationFail{Reason: "failed to validate integrity of roots"})
+	}
+}
+
+// TestValidateSuccessfulRootRotation runs through a full root certificate rotation
+// We test this with both an RSA and ECDSA root certificate
+func TestValidateSuccessfulRootRotation(t *testing.T) {
+	testValidateSuccessfulRootRotation(t, data.ECDSAKey, data.ECDSAx509Key)
+	if !testing.Short() {
+		testValidateSuccessfulRootRotation(t, data.RSAKey, data.RSAx509Key)
+	}
+}
+
+// Generates a KeyStoreManager in a temporary directory and returns the
+// manager and certificates for two keys which have been added to the keystore.
+// Also returns the temporary directory so it can be cleaned up.
+func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
+	string, *KeyStoreManager, []*x509.Certificate) {
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
+
+	keysPath := filepath.Join(tempBaseDir, notary.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	assert.NoError(t, err)
+
+	// Create a FileStoreManager
+	keyStoreManager, err := NewKeyStoreManager(tempBaseDir, fileKeyStore)
+	assert.NoError(t, err)
+
+	certs := make([]*x509.Certificate, 2)
+	for i := 0; i < 2; i++ {
+		keyID, err := keyStoreManager.GenRootKey(keyAlg)
+		assert.NoError(t, err)
+
+		key, _, err := keyStoreManager.KeyStore.GetKey(keyID)
+		assert.NoError(t, err)
+
+		cert, err := cryptoservice.GenerateCertificate(key, gun)
+		assert.NoError(t, err)
+
+		certs[i] = cert
+	}
+	return tempBaseDir, keyStoreManager, certs
+}
+
+func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string) {
+	// The gun to test
+	gun := "docker.com/notary"
+
+	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+	defer os.RemoveAll(tempBaseDir)
+	origRootCert := certs[0]
+	replRootCert := certs[1]
+
+	// Add the old root cert part of trustedCertificates
+	keyStoreManager.AddTrustedCert(origRootCert)
+
+	// We need the PEM representation of the replacement key to put it into the TUF data
+	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
+	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+
+	// Tuf key with PEM-encoded x509 certificate
+	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
+	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+
+	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+	assert.NoError(t, err)
+
+	testRoot, err := data.NewRoot(
+		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+		map[string]*data.RootRole{"root": &rootRole.RootRole},
+		false,
+	)
+	assert.NoError(t, err, "Failed to create new root")
+
+	signedTestRoot, err := testRoot.ToSigned()
+	assert.NoError(t, err)
+
+	cs := cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
+
+	err = signed.Sign(cs, signedTestRoot, replRootKey)
+	assert.NoError(t, err)
+
+	err = signed.Sign(cs, signedTestRoot, origRootKey)
+	assert.NoError(t, err)
+
+	//
+	// This call to ValidateRoot will succeed since we are using a valid PEM
+	// encoded certificate, and have no other certificates for this CN
+	//
+	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+	assert.NoError(t, err)
+
+	// Finally, validate the only trusted certificate that exists is the new one
+	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+	assert.Len(t, certs, 1)
+	assert.Equal(t, certs[0], replRootCert)
+}
+
+// TestValidateRootRotationMissingOrigSig runs through a full root certificate rotation
+// where we are missing the original root key signature. Verification should fail.
+// We test this with both an RSA and ECDSA root certificate
+func TestValidateRootRotationMissingOrigSig(t *testing.T) {
+	testValidateRootRotationMissingOrigSig(t, data.ECDSAKey, data.ECDSAx509Key)
+	if !testing.Short() {
+		testValidateRootRotationMissingOrigSig(t, data.RSAKey, data.RSAx509Key)
+	}
+}
+
+func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType string) {
+	gun := "docker.com/notary"
+
+	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+	defer os.RemoveAll(tempBaseDir)
+	origRootCert := certs[0]
+	replRootCert := certs[1]
+
+	// Add the old root cert part of trustedCertificates
+	keyStoreManager.AddTrustedCert(origRootCert)
+
+	// We need the PEM representation of the replacement key to put it into the TUF data
+	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+
+	// Tuf key with PEM-encoded x509 certificate
+	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+
+	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+	assert.NoError(t, err)
+
+	testRoot, err := data.NewRoot(
+		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+		map[string]*data.RootRole{"root": &rootRole.RootRole},
+		false,
+	)
+	assert.NoError(t, err, "Failed to create new root")
+
+	signedTestRoot, err := testRoot.ToSigned()
+	assert.NoError(t, err)
+
+	// We only sign with the new key, and not with the original one.
+	err = signed.Sign(
+		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
+		signedTestRoot, replRootKey)
+	assert.NoError(t, err)
+
+	//
+	// This call to ValidateRoot will succeed since we are using a valid PEM
+	// encoded certificate, and have no other certificates for this CN
+	//
+	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+	assert.Error(t, err, "insuficient signatures on root")
+
+	// Finally, validate the only trusted certificate that exists is still
+	// the old one
+	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+	assert.Len(t, certs, 1)
+	assert.Equal(t, certs[0], origRootCert)
+}
+
+// TestValidateRootRotationMissingNewSig runs through a full root certificate rotation
+// where we are missing the new root key signature. Verification should fail.
+// We test this with both an RSA and ECDSA root certificate
+func TestValidateRootRotationMissingNewSig(t *testing.T) {
+	testValidateRootRotationMissingNewSig(t, data.ECDSAKey, data.ECDSAx509Key)
+	if !testing.Short() {
+		testValidateRootRotationMissingNewSig(t, data.RSAKey, data.RSAx509Key)
+	}
+}
+
+func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType string) {
+	gun := "docker.com/notary"
+
+	tempBaseDir, keyStoreManager, certs := filestoreWithTwoCerts(t, gun, keyAlg)
+	defer os.RemoveAll(tempBaseDir)
+	origRootCert := certs[0]
+	replRootCert := certs[1]
+
+	// Add the old root cert part of trustedCertificates
+	keyStoreManager.AddTrustedCert(origRootCert)
+
+	// We need the PEM representation of the replacement key to put it into the TUF data
+	origRootPEMCert := trustmanager.CertToPEM(origRootCert)
+	replRootPEMCert := trustmanager.CertToPEM(replRootCert)
+
+	// Tuf key with PEM-encoded x509 certificate
+	origRootKey := data.NewPublicKey(rootKeyType, origRootPEMCert)
+	replRootKey := data.NewPublicKey(rootKeyType, replRootPEMCert)
+
+	rootRole, err := data.NewRole("root", 1, []string{replRootKey.ID()}, nil, nil)
+	assert.NoError(t, err)
+
+	testRoot, err := data.NewRoot(
+		map[string]data.PublicKey{replRootKey.ID(): replRootKey},
+		map[string]*data.RootRole{"root": &rootRole.RootRole},
+		false,
+	)
+	assert.NoError(t, err, "Failed to create new root")
+
+	signedTestRoot, err := testRoot.ToSigned()
+	assert.NoError(t, err)
+
+	// We only sign with the old key, and not with the new one
+	err = signed.Sign(
+		cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore),
+		signedTestRoot, origRootKey)
+	assert.NoError(t, err)
+
+	//
+	// This call to ValidateRoot will succeed since we are using a valid PEM
+	// encoded certificate, and have no other certificates for this CN
+	//
+	err = keyStoreManager.ValidateRoot(signedTestRoot, gun)
+	assert.Error(t, err, "insuficient signatures on root")
+
+	// Finally, validate the only trusted certificate that exists is still
+	// the old one
+	certs = keyStoreManager.trustedCertificateStore.GetCertificates()
+	assert.Len(t, certs, 1)
+	assert.Equal(t, certs[0], origRootCert)
+}
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 1042f24d20..82f4bf5bd2 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -504,7 +504,8 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 
 	if k, ok := s.keys[keyID]; ok {
 		if k.role == role {
-
+			// already have the key and it's associated with the correct role
+			return nil
 		}
 	}
 
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index e364669e46..ed8339cfe1 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -329,12 +329,17 @@ func encryptAndAddKey(s LimitedFileStore, passwd string, cachedKeys map[string]*
 
 func importKey(s LimitedFileStore, passphraseRetriever passphrase.Retriever, cachedKeys map[string]*cachedKey, alias string, pemBytes []byte) error {
 
+	if alias != data.CanonicalRootRole {
+		return s.Add(alias, pemBytes)
+	}
+
 	privKey, passphrase, err := GetPasswdDecryptBytes(passphraseRetriever, pemBytes, "imported", alias)
 
 	if err != nil {
 		return err
 	}
 
-	return encryptAndAddKey(
-		s, passphrase, cachedKeys, privKey.ID(), alias, privKey)
+	var name string
+	name = privKey.ID()
+	return encryptAndAddKey(s, passphrase, cachedKeys, name, alias, privKey)
 }

From beca50909d2cd0555bd07065d68d0b74ef9ffe13 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 08:26:27 -0800
Subject: [PATCH 25/85] update to only use slots 0-3 Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 82f4bf5bd2..75aa5bf9df 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -24,7 +24,7 @@ import (
 const (
 	USER_PIN    = "123456"
 	SO_USER_PIN = "010203040506070801020304050607080102030405060708"
-	numSlots    = 50 // number of slots in the yubikey
+	numSlots    = 4 // number of slots in the yubikey
 )
 
 // Hardcoded yubikey PKCS11 ID
@@ -421,27 +421,27 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 		}
 		objs = append(objs, o...)
 	}
-	taken := make([]bool, numSlots)
+	taken := make(map[int]bool)
 	if err != nil {
 		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
 		return nil, err
 	}
 	for _, obj := range objs {
-		// Retrieve the public-key material to be able to create a new HSMRSAKey
+		// Retrieve the slot ID
 		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
 		if err != nil {
 			logrus.Debugf("Failed to get Attribute for: %v\n", obj)
 			continue
 		}
 
-		// Iterate through all the attributes of this key and saves CKA_PUBLIC_EXPONENT and CKA_MODULUS. Removes ordering specific issues.
+		// Iterate through attributes. If an ID attr was found, mark it as taken
 		for _, a := range attr {
 			if a.Type == pkcs11.CKA_ID {
 				if len(a.Value) < 1 {
 					continue
 				}
-				// max 50 slots so a single byte will always represent
-				// all possible slots positions
+				// a byte will always be capable of representing all slot IDs
+				// for the Yubikeys
 				slotNum := int(a.Value[0])
 				if slotNum >= len(taken) {
 					// defensive

From 705587b0b5ec5c1fe46a53743e9620a0788d0c35 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 08:29:38 -0800
Subject: [PATCH 26/85] update yubikeystore keys cache when adding
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 75aa5bf9df..5439e05b7e 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -514,7 +514,14 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 		return err
 	}
 	logrus.Debugf("Using yubikey slot %v", slot)
-	return addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role)
+	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role)
+	if err == nil {
+		s.keys[privKey.ID()] = yubiSlot{
+			role:   role,
+			slotID: slot,
+		}
+	}
+	return err
 }
 
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {

From e8d2240c796675a9d4b5697f05ed89993c154041 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 12:03:02 -0800
Subject: [PATCH 27/85] write private key to a backup dir when creating keys on
 yubikey Signed-off-by: David Lawrence <david.lawrence@docker.com> (github:
 endophage)

---
 client/repo_pkcs11.go                       | 11 +++++--
 cmd/notary/keys.go                          | 32 ++++++++++++++----
 const.go                                    |  5 ++-
 signer/api/ecdsa_hardware_crypto_service.go | 36 ++++++++++++++++++---
 signer/signer_trust.go                      |  5 +++
 trustmanager/filestore.go                   |  5 +--
 tuf/signed/ed25519.go                       | 20 ++++++++++++
 tuf/signed/interface.go                     |  5 +++
 tuf/signed/sign_test.go                     | 13 ++++++++
 9 files changed, 117 insertions(+), 15 deletions(-)

diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index 5f6fc7792e..763144ea1e 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -13,6 +13,7 @@ import (
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/tuf/signed"
 	"github.com/docker/notary/tuf/store"
 )
 
@@ -23,14 +24,20 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 
 	keysPath := filepath.Join(baseDir, notary.PrivDir)
+	backupPath := filepath.Join(baseDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
-	yubiKeyStore := api.NewYubiKeyStore(retriever)
-	cryptoService := cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
+	yubiKeyStore, _ := api.NewYubiKeyStore(backupPath, retriever)
+	var cryptoService signed.CryptoService
+	if yubiKeyStore == nil {
+		cryptoService = cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
+	} else {
+		cryptoService = cryptoservice.NewCryptoService(gun, yubiKeyStore, keyStoreManager.KeyStore)
+	}
 
 	nRepo := &NotaryRepository{
 		gun:             gun,
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 36c5d578ba..11e134c5c3 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -16,6 +16,7 @@ import (
 	"github.com/docker/notary/trustmanager"
 
 	"github.com/docker/notary/tuf/data"
+	"github.com/docker/notary/tuf/signed"
 	"github.com/spf13/cobra"
 )
 
@@ -116,12 +117,18 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
+	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore := api.NewYubiKeyStore(retriever)
-	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	yubiStore, _ := api.NewYubiKeyStore(backupPath, retriever)
+	var cs signed.CryptoService
+	if yubiStore == nil {
+		cs = cryptoservice.NewCryptoService("", fileKeyStore)
+	} else {
+		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	}
 
 	keyID := args[0]
 
@@ -158,12 +165,18 @@ func keysList(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
+	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore := api.NewYubiKeyStore(retriever)
-	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	yubiStore, _ := api.NewYubiKeyStore(backupPath, retriever)
+	var cs signed.CryptoService
+	if yubiStore == nil {
+		cs = cryptoservice.NewCryptoService("", fileKeyStore)
+	} else {
+		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	}
 
 	// Get a map of all the keys/roles
 	keysMap := cs.ListAllKeys()
@@ -353,12 +366,19 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
+	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore := api.NewYubiKeyStore(retriever)
-	cs := cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	yubiStore, err := api.NewYubiKeyStore(backupPath, retriever)
+	var cs signed.CryptoService
+	if err != nil {
+		cmd.Printf("No Yubikey detected, importing to local filesystem.")
+		cs = cryptoservice.NewCryptoService("", fileKeyStore)
+	} else {
+		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	}
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
diff --git a/const.go b/const.go
index 5b1734a9a7..41d80de393 100644
--- a/const.go
+++ b/const.go
@@ -2,5 +2,8 @@ package notary
 
 // application wide constants
 const (
-	PrivDir = "private"
+	BackupDir    = "backup"
+	PrivDir      = "private"
+	PrivKeyPerms = 0700
+	PubCertPerms = 0755
 )
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 5439e05b7e..ba6bc48bdf 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -12,9 +12,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"math/big"
+	"os"
+	"path"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
@@ -30,6 +34,14 @@ const (
 // Hardcoded yubikey PKCS11 ID
 var YUBIKEY_ROOT_KEY_ID = []byte{2}
 
+type ErrBackupFailed struct {
+	path string
+}
+
+func (err ErrBackupFailed) Error() string {
+	return fmt.Sprintf("Failed to backup private key to: %s", err.path)
+}
+
 type yubiSlot struct {
 	role   string
 	slotID []byte
@@ -96,7 +108,7 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 }
 
 // addECDSAKey adds a key to the yubikey
-func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever, role string) error {
+func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever, role, backupPath string) error {
 	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
 
 	// TODO(diogo): Figure out CKU_SO with yubikey
@@ -153,6 +165,16 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 		return fmt.Errorf("error importing: %v", err)
 	}
 
+	backupTo := path.Join(backupPath, role, privKey.ID())
+	err = ioutil.WriteFile(
+		backupTo,
+		privKey.Private(),
+		notary.PrivKeyPerms,
+	)
+	if err != nil {
+		return ErrBackupFailed{path: backupTo}
+	}
+
 	return nil
 }
 
@@ -462,15 +484,21 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
+	backupPath    string
 }
 
-func NewYubiKeyStore(passphraseRetriever passphrase.Retriever) *YubiKeyStore {
+func NewYubiKeyStore(backupPath string, passphraseRetriever passphrase.Retriever) (*YubiKeyStore, error) {
+	err := os.MkdirAll(backupPath, notary.PrivKeyPerms)
+	if err != nil {
+		return nil, err
+	}
 	s := &YubiKeyStore{
 		passRetriever: passphraseRetriever,
 		keys:          make(map[string]yubiSlot),
+		backupPath:    backupPath,
 	}
 	s.ListKeys() // populate keys field
-	return s
+	return s, err
 }
 
 func (s *YubiKeyStore) ListKeys() map[string]string {
@@ -514,7 +542,7 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 		return err
 	}
 	logrus.Debugf("Using yubikey slot %v", slot)
-	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role)
+	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role, s.backupPath)
 	if err == nil {
 		s.keys[privKey.ID()] = yubiSlot{
 			role:   role,
diff --git a/signer/signer_trust.go b/signer/signer_trust.go
index 200eb5f583..e62cacc25b 100644
--- a/signer/signer_trust.go
+++ b/signer/signer_trust.go
@@ -4,6 +4,7 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"time"
 
@@ -131,3 +132,7 @@ func (trust *NotarySigner) CheckHealth(timeout time.Duration) error {
 	}
 	return err
 }
+
+func (trust *NotarySigner) ImportRootKey(r io.Reader) error {
+	return errors.New("Importing a root key to NotarySigner is not supported")
+}
diff --git a/trustmanager/filestore.go b/trustmanager/filestore.go
index 4dd106ca35..e5172997b6 100644
--- a/trustmanager/filestore.go
+++ b/trustmanager/filestore.go
@@ -3,6 +3,7 @@ package trustmanager
 import (
 	"errors"
 	"fmt"
+	"github.com/docker/notary"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -11,8 +12,8 @@ import (
 )
 
 const (
-	visible os.FileMode = 0755
-	private os.FileMode = 0700
+	visible = notary.PubCertPerms
+	private = notary.PrivKeyPerms
 )
 
 var (
diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index 4aabb2403c..3ab1e8af78 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -3,6 +3,8 @@ package signed
 import (
 	"crypto/rand"
 	"errors"
+	"io"
+	"io/ioutil"
 
 	"github.com/agl/ed25519"
 	"github.com/docker/notary/tuf/data"
@@ -116,3 +118,21 @@ func (e *Ed25519) GetKey(keyID string) data.PublicKey {
 func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
 	return e.keys[keyID].privKey, "", nil
 }
+
+func (e *Ed25519) ImportRootKey(r io.Reader) error {
+	raw, err := ioutil.ReadAll(r)
+	if err != nil {
+		return err
+	}
+	dataSize := ed25519.PublicKeySize + ed25519.PrivateKeySize
+	if len(raw) < dataSize || len(raw) > dataSize {
+		return errors.New("Wrong length of data for Ed25519 Key Import")
+	}
+	public := data.NewED25519PublicKey(raw[:ed25519.PublicKeySize])
+	private, err := data.NewED25519PrivateKey(*public, raw[ed25519.PublicKeySize:])
+	e.keys[private.ID()] = edCryptoKey{
+		role:    "root",
+		privKey: private,
+	}
+	return nil
+}
diff --git a/tuf/signed/interface.go b/tuf/signed/interface.go
index e9db58c492..ecd680e861 100644
--- a/tuf/signed/interface.go
+++ b/tuf/signed/interface.go
@@ -2,6 +2,7 @@ package signed
 
 import (
 	"github.com/docker/notary/tuf/data"
+	"io"
 )
 
 // SigningService defines the necessary functions to determine
@@ -37,6 +38,10 @@ type KeyService interface {
 
 	// ListAllKeys returns a map of all available signing key IDs to role
 	ListAllKeys() map[string]string
+
+	// ImportRootKey imports a root key to the highest priority keystore associated with
+	// the cryptoservice
+	ImportRootKey(source io.Reader) error
 }
 
 // CryptoService defines a unified Signing and Key Service as this
diff --git a/tuf/signed/sign_test.go b/tuf/signed/sign_test.go
index f7228b5acf..9b809bde3e 100644
--- a/tuf/signed/sign_test.go
+++ b/tuf/signed/sign_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
+	"io"
 	"testing"
 
 	"github.com/docker/notary/trustmanager"
@@ -62,6 +63,10 @@ func (mts *FailingCryptoService) RemoveKey(keyID string) error {
 	return nil
 }
 
+func (mts *FailingCryptoService) ImportRootKey(r io.Reader) error {
+	return nil
+}
+
 type MockCryptoService struct {
 	testKey data.PublicKey
 }
@@ -106,6 +111,10 @@ func (mts *MockCryptoService) RemoveKey(keyID string) error {
 	return nil
 }
 
+func (mts *MockCryptoService) ImportRootKey(r io.Reader) error {
+	return nil
+}
+
 var _ CryptoService = &MockCryptoService{}
 
 type StrictMockCryptoService struct {
@@ -142,6 +151,10 @@ func (mts *StrictMockCryptoService) ListAllKeys() map[string]string {
 	}
 }
 
+func (mts *StrictMockCryptoService) ImportRootKey(r io.Reader) error {
+	return nil
+}
+
 // Test signing and ensure the expected signature is added
 func TestBasicSign(t *testing.T) {
 	testKey, _ := pem.Decode([]byte(testKeyPEM1))

From 51a99a4127c385c7cd63fc20243b95d592c68f2a Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 14:58:55 -0800
Subject: [PATCH 28/85] generate should instantiate a yubikeystore
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 11e134c5c3..f97efbc271 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -227,11 +227,19 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
+	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	yubiStore, err := api.NewYubiKeyStore(backupPath, retriever)
+	var cs signed.CryptoService
+	if err != nil {
+		cmd.Printf("No Yubikey detected, importing to local filesystem.")
+		cs = cryptoservice.NewCryptoService("", fileKeyStore)
+	} else {
+		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
+	}
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
 	if err != nil {

From f9cf7bcca593b82293fc1265a7c14b1e55d62360 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 15:07:23 -0800
Subject: [PATCH 29/85] remove needs to list keys to find guns Signed-off-by:
 David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index f97efbc271..4793a25600 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -137,6 +137,18 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 		fatalf("invalid key ID provided: %s", keyID)
 	}
 
+	keyMap := cs.ListAllKeys()
+	var key string
+	for k := range keyMap {
+		if filepath.Base(k) == keyID {
+			key = k
+		}
+	}
+
+	if key == "" {
+		fatalf("key with key ID: %s not found\n", keyID)
+	}
+
 	// List the key about to be removed
 	fmt.Println("Are you sure you want to remove the following key?")
 	fmt.Printf("%s\n(yes/no)\n", keyID)
@@ -150,7 +162,7 @@ func keysRemoveKey(cmd *cobra.Command, args []string) {
 	}
 
 	// Attempt to remove the key
-	err = cs.RemoveKey(keyID)
+	err = cs.RemoveKey(key)
 	if err != nil {
 		fatalf("failed to remove key with key ID: %s, %v", keyID, err)
 	}

From de9f6514942c7f34c5a68c058816c1bba6aae68d Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 15:14:07 -0800
Subject: [PATCH 30/85] fixing lint comments Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 signer/signer_trust.go | 2 ++
 tuf/signed/ed25519.go  | 1 +
 2 files changed, 3 insertions(+)

diff --git a/signer/signer_trust.go b/signer/signer_trust.go
index e62cacc25b..53ae075415 100644
--- a/signer/signer_trust.go
+++ b/signer/signer_trust.go
@@ -133,6 +133,8 @@ func (trust *NotarySigner) CheckHealth(timeout time.Duration) error {
 	return err
 }
 
+// ImportRootKey satisfies the CryptoService interface. It should not be implemented
+// for a NotarySigner.
 func (trust *NotarySigner) ImportRootKey(r io.Reader) error {
 	return errors.New("Importing a root key to NotarySigner is not supported")
 }
diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index 3ab1e8af78..dc5ea00f23 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -119,6 +119,7 @@ func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
 	return e.keys[keyID].privKey, "", nil
 }
 
+// ImportRootKey adds an Ed25519 key to the store as a root key
 func (e *Ed25519) ImportRootKey(r io.Reader) error {
 	raw, err := ioutil.ReadAll(r)
 	if err != nil {

From a3336e696ec0ef2ffbb39df9f84258ef09aa630b Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 16:04:38 -0800
Subject: [PATCH 31/85] removekey had an errant return Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cryptoservice/crypto_service.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 8aa0f214f7..583754a43a 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -110,7 +110,6 @@ func (cs *CryptoService) RemoveKey(keyID string) (err error) {
 				continue
 			}
 			err = ks.RemoveKey(keyPath)
-			return
 		}
 	}
 	return // returns whatever the final values were

From 72cd24ac134e045dce995fdb41cc065201946b21 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 16:10:01 -0800
Subject: [PATCH 32/85] explicit return in yubikeystore.AddKey to see if
 interface typing is causing weird behaviour Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index ba6bc48bdf..fbc59e79bd 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -548,6 +548,7 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 			role:   role,
 			slotID: slot,
 		}
+		return nil
 	}
 	return err
 }

From 2d4612c7031680b6a9428434d7ad70947f952ca7 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 16:13:34 -0800
Subject: [PATCH 33/85] removekey is going to be best effort Signed-off-by:
 David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cryptoservice/crypto_service.go | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index 583754a43a..e825a3d462 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -105,11 +105,7 @@ func (cs *CryptoService) RemoveKey(keyID string) (err error) {
 	keyPaths := []string{keyID, filepath.Join(cs.gun, keyID)}
 	for _, ks := range cs.keyStores {
 		for _, keyPath := range keyPaths {
-			_, _, err = ks.GetKey(keyPath)
-			if err != nil {
-				continue
-			}
-			err = ks.RemoveKey(keyPath)
+			ks.RemoveKey(keyPath)
 		}
 	}
 	return // returns whatever the final values were

From 542c4a6d32a11487f01f6e7e98aa08367b544319 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 16:31:34 -0800
Subject: [PATCH 34/85] removing role from backup key path Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 signer/api/ecdsa_hardware_crypto_service.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index fbc59e79bd..cbb7e38ba2 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -165,7 +165,7 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 		return fmt.Errorf("error importing: %v", err)
 	}
 
-	backupTo := path.Join(backupPath, role, privKey.ID())
+	backupTo := path.Join(backupPath, privKey.ID())
 	err = ioutil.WriteFile(
 		backupTo,
 		privKey.Private(),

From 91e8b9bcdba54772a0e7e61ca83aea6af69362bf Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Sat, 7 Nov 2015 18:03:45 -0800
Subject: [PATCH 35/85] backup to a KeyFileStore and take out key remove
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 client/repo_pkcs11.go                       |  3 +-
 cmd/notary/keys.go                          | 85 +--------------------
 signer/api/ecdsa_hardware_crypto_service.go | 41 +++++-----
 3 files changed, 22 insertions(+), 107 deletions(-)

diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index 763144ea1e..260aaca742 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -24,14 +24,13 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 
 	keysPath := filepath.Join(baseDir, notary.PrivDir)
-	backupPath := filepath.Join(baseDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
-	yubiKeyStore, _ := api.NewYubiKeyStore(backupPath, retriever)
+	yubiKeyStore, _ := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cryptoService signed.CryptoService
 	if yubiKeyStore == nil {
 		cryptoService = cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 4793a25600..7a9c82bbfe 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -22,10 +22,6 @@ import (
 
 func init() {
 	cmdKey.AddCommand(cmdKeyList)
-	cmdKey.AddCommand(cmdKeyRemoveKey)
-	cmdKeyRemoveKey.Flags().StringVarP(&keyRemoveGUN, "gun", "g", "", "Globally unique name to remove keys for")
-	cmdKeyRemoveKey.Flags().BoolVarP(&keyRemoveRoot, "root", "r", false, "Remove root keys")
-	cmdKeyRemoveKey.Flags().BoolVarP(&keyRemoveYes, "yes", "y", false, "Answer yes to the removal question (no confirmation)")
 	cmdKey.AddCommand(cmdKeyGenerateRootKey)
 
 	cmdKeyExport.Flags().StringVarP(&keysExportGUN, "gun", "g", "", "Globally unique name to export keys for")
@@ -57,17 +53,6 @@ var cmdRotateKey = &cobra.Command{
 	Run:   keysRotate,
 }
 
-var keyRemoveGUN string
-var keyRemoveRoot bool
-var keyRemoveYes bool
-
-var cmdKeyRemoveKey = &cobra.Command{
-	Use:   "remove [ keyID ]",
-	Short: "Removes the key with the given keyID.",
-	Long:  "remove the key with the given keyID from the local host.",
-	Run:   keysRemoveKey,
-}
-
 var cmdKeyGenerateRootKey = &cobra.Command{
 	Use:   "generate [ algorithm ]",
 	Short: "Generates a new root key with a given algorithm.",
@@ -107,67 +92,6 @@ var cmdKeyImportRoot = &cobra.Command{
 	Run:   keysImportRoot,
 }
 
-// keysRemoveKey deletes a private key based on ID
-func keysRemoveKey(cmd *cobra.Command, args []string) {
-	if len(args) < 1 {
-		cmd.Usage()
-		fatalf("must specify the key ID of the key to remove")
-	}
-
-	parseConfig()
-
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	backupPath := filepath.Join(trustDir, notary.BackupDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
-	}
-	yubiStore, _ := api.NewYubiKeyStore(backupPath, retriever)
-	var cs signed.CryptoService
-	if yubiStore == nil {
-		cs = cryptoservice.NewCryptoService("", fileKeyStore)
-	} else {
-		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
-	}
-
-	keyID := args[0]
-
-	// This is an invalid ID
-	if len(keyID) != idSize {
-		fatalf("invalid key ID provided: %s", keyID)
-	}
-
-	keyMap := cs.ListAllKeys()
-	var key string
-	for k := range keyMap {
-		if filepath.Base(k) == keyID {
-			key = k
-		}
-	}
-
-	if key == "" {
-		fatalf("key with key ID: %s not found\n", keyID)
-	}
-
-	// List the key about to be removed
-	fmt.Println("Are you sure you want to remove the following key?")
-	fmt.Printf("%s\n(yes/no)\n", keyID)
-
-	// Ask for confirmation before removing the key, unless -y is passed
-	if !keyRemoveYes {
-		confirmed := askConfirm()
-		if !confirmed {
-			fatalf("aborting action.")
-		}
-	}
-
-	// Attempt to remove the key
-	err = cs.RemoveKey(key)
-	if err != nil {
-		fatalf("failed to remove key with key ID: %s, %v", keyID, err)
-	}
-}
-
 func keysList(cmd *cobra.Command, args []string) {
 	if len(args) > 0 {
 		cmd.Usage()
@@ -177,12 +101,11 @@ func keysList(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore, _ := api.NewYubiKeyStore(backupPath, retriever)
+	yubiStore, _ := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
 	if yubiStore == nil {
 		cs = cryptoservice.NewCryptoService("", fileKeyStore)
@@ -239,12 +162,11 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore, err := api.NewYubiKeyStore(backupPath, retriever)
+	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
 	if err != nil {
 		cmd.Printf("No Yubikey detected, importing to local filesystem.")
@@ -386,12 +308,11 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	backupPath := filepath.Join(trustDir, notary.BackupDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
 		fatalf("failed to create private key store in directory: %s", keysPath)
 	}
-	yubiStore, err := api.NewYubiKeyStore(backupPath, retriever)
+	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
 	if err != nil {
 		cmd.Printf("No Yubikey detected, importing to local filesystem.")
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index cbb7e38ba2..a3acc2f0a8 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -12,13 +12,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/big"
-	"os"
-	"path"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
@@ -35,11 +31,11 @@ const (
 var YUBIKEY_ROOT_KEY_ID = []byte{2}
 
 type ErrBackupFailed struct {
-	path string
+	err string
 }
 
 func (err ErrBackupFailed) Error() string {
-	return fmt.Sprintf("Failed to backup private key to: %s", err.path)
+	return fmt.Sprintf("Failed to backup private key to: %s", err.err)
 }
 
 type yubiSlot struct {
@@ -108,7 +104,15 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 }
 
 // addECDSAKey adds a key to the yubikey
-func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.PrivateKey, pkcs11KeyID []byte, passRetriever passphrase.Retriever, role, backupPath string) error {
+func addECDSAKey(
+	ctx *pkcs11.Ctx,
+	session pkcs11.SessionHandle,
+	privKey data.PrivateKey,
+	pkcs11KeyID []byte,
+	passRetriever passphrase.Retriever,
+	role string,
+	backupStore trustmanager.KeyStore,
+) error {
 	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
 
 	// TODO(diogo): Figure out CKU_SO with yubikey
@@ -165,14 +169,9 @@ func addECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, privKey data.Pri
 		return fmt.Errorf("error importing: %v", err)
 	}
 
-	backupTo := path.Join(backupPath, privKey.ID())
-	err = ioutil.WriteFile(
-		backupTo,
-		privKey.Private(),
-		notary.PrivKeyPerms,
-	)
+	err = backupStore.AddKey(privKey.ID(), role, privKey)
 	if err != nil {
-		return ErrBackupFailed{path: backupTo}
+		return ErrBackupFailed{err: err.Error()}
 	}
 
 	return nil
@@ -484,21 +483,17 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
-	backupPath    string
+	backupStore   trustmanager.KeyStore
 }
 
-func NewYubiKeyStore(backupPath string, passphraseRetriever passphrase.Retriever) (*YubiKeyStore, error) {
-	err := os.MkdirAll(backupPath, notary.PrivKeyPerms)
-	if err != nil {
-		return nil, err
-	}
+func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) (*YubiKeyStore, error) {
 	s := &YubiKeyStore{
 		passRetriever: passphraseRetriever,
 		keys:          make(map[string]yubiSlot),
-		backupPath:    backupPath,
+		backupStore:   backupStore,
 	}
 	s.ListKeys() // populate keys field
-	return s, err
+	return s, nil
 }
 
 func (s *YubiKeyStore) ListKeys() map[string]string {
@@ -542,7 +537,7 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 		return err
 	}
 	logrus.Debugf("Using yubikey slot %v", slot)
-	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role, s.backupPath)
+	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role, s.backupStore)
 	if err == nil {
 		s.keys[privKey.ID()] = yubiSlot{
 			role:   role,

From 107489704015f96fdd02ca214273021b0233a81e Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 3 Nov 2015 10:47:14 -0800
Subject: [PATCH 36/85] delete non-root keys from cryptoservice when they get
 rotated out Signed-off-by: David Lawrence <david.lawrence@docker.com>
 (github: endophage)

---
 tuf/tuf.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tuf/tuf.go b/tuf/tuf.go
index 33dd9448a8..a5f5d98f74 100644
--- a/tuf/tuf.go
+++ b/tuf/tuf.go
@@ -146,6 +146,12 @@ func (tr *Repo) RemoveBaseKeys(role string, keyIDs ...string) error {
 	// remove keys no longer in use by any roles
 	for k := range toDelete {
 		delete(tr.Root.Signed.Keys, k)
+		// remove the signing key from the cryptoservice if it
+		// isn't a root key. Root keys must be kept for rotation
+		// signing
+		if role != data.CanonicalRootRole {
+			tr.cryptoService.RemoveKey(k)
+		}
 	}
 	tr.Root.Dirty = true
 	return nil

From 1f1868d3ee03fcd95f5b759e87be676a6a320f80 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Fri, 6 Nov 2015 11:00:50 -0800
Subject: [PATCH 37/85] Adding integration tests for notary client.

This runs through the basic notary init/add/publish/etc. workflow,
and some basic key workflows.

Note that this does work with the Yubikey, in that created keys while
testing do not require touch.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/cert.go                          |  17 +-
 cmd/notary/integration_nonpkcs11_test.go    |  34 ++
 cmd/notary/integration_pkcs11_test.go       |  63 +++
 cmd/notary/integration_test.go              | 513 ++++++++++++++++++++
 cmd/notary/keys.go                          |  24 +-
 cmd/notary/main.go                          |  17 +-
 cmd/notary/tuf.go                           |  24 +-
 signer/api/ecdsa_hardware_crypto_service.go |  36 +-
 8 files changed, 683 insertions(+), 45 deletions(-)
 create mode 100644 cmd/notary/integration_nonpkcs11_test.go
 create mode 100644 cmd/notary/integration_pkcs11_test.go
 create mode 100644 cmd/notary/integration_test.go

diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index b4357980e5..2e4789177d 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -2,7 +2,6 @@ package main
 
 import (
 	"crypto/x509"
-	"fmt"
 	"math"
 	"os"
 	"path/filepath"
@@ -92,14 +91,14 @@ func certRemove(cmd *cobra.Command, args []string) {
 	}
 
 	// List all the keys about to be removed
-	fmt.Printf("The following certificates will be removed:\n\n")
+	cmd.Printf("The following certificates will be removed:\n\n")
 	for _, cert := range certsToRemove {
 		// This error can't occur because we're getting certs off of an
 		// x509 store that indexes by ID.
 		certID, _ := trustmanager.FingerprintCert(cert)
-		fmt.Printf("%s - %s\n", cert.Subject.CommonName, certID)
+		cmd.Printf("%s - %s\n", cert.Subject.CommonName, certID)
 	}
-	fmt.Println("\nAre you sure you want to remove these certificates? (yes/no)")
+	cmd.Println("\nAre you sure you want to remove these certificates? (yes/no)")
 
 	// Ask for confirmation before removing certificates, unless -y is provided
 	if !certRemoveYes {
@@ -136,20 +135,20 @@ func certList(cmd *cobra.Command, args []string) {
 		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
 	}
 
-	fmt.Println("")
-	fmt.Println("# Trusted Certificates:")
+	cmd.Println("")
+	cmd.Println("# Trusted Certificates:")
 	trustedCerts := keyStoreManager.TrustedCertificateStore().GetCertificates()
 	for _, c := range trustedCerts {
-		printCert(c)
+		printCert(cmd, c)
 	}
 }
 
-func printCert(cert *x509.Certificate) {
+func printCert(cmd *cobra.Command, cert *x509.Certificate) {
 	timeDifference := cert.NotAfter.Sub(time.Now())
 	certID, err := trustmanager.FingerprintCert(cert)
 	if err != nil {
 		fatalf("could not fingerprint certificate: %v", err)
 	}
 
-	fmt.Printf("%s %s (expires in: %v days)\n", cert.Subject.CommonName, certID, math.Floor(timeDifference.Hours()/24))
+	cmd.Printf("%s %s (expires in: %v days)\n", cert.Subject.CommonName, certID, math.Floor(timeDifference.Hours()/24))
 }
diff --git a/cmd/notary/integration_nonpkcs11_test.go b/cmd/notary/integration_nonpkcs11_test.go
new file mode 100644
index 0000000000..5247a10d08
--- /dev/null
+++ b/cmd/notary/integration_nonpkcs11_test.go
@@ -0,0 +1,34 @@
+// +build !pkcs11
+
+package main
+
+import (
+	"testing"
+
+	"github.com/docker/notary/passphrase"
+)
+
+func rootOnHardware() bool {
+	return false
+}
+
+// Per-test set up that returns a cleanup function.  This set up changes the
+// passphrase retriever to always produce a constant passphrase
+func setUp(t *testing.T) func() {
+	oldRetriever := retriever
+
+	var fake = func(k, a string, c bool, n int) (string, bool, error) {
+		return testPassphrase, false, nil
+	}
+
+	retriever = fake
+	getRetriever = func() passphrase.Retriever { return fake }
+
+	return func() {
+		retriever = oldRetriever
+		getRetriever = getPassphraseRetriever
+	}
+}
+
+// no-op
+func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) {}
diff --git a/cmd/notary/integration_pkcs11_test.go b/cmd/notary/integration_pkcs11_test.go
new file mode 100644
index 0000000000..436bbee373
--- /dev/null
+++ b/cmd/notary/integration_pkcs11_test.go
@@ -0,0 +1,63 @@
+// +build pkcs11
+
+package main
+
+import (
+	"testing"
+
+	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/tuf/data"
+	"github.com/stretchr/testify/assert"
+)
+
+var rootOnHardware = api.YubikeyAccessible
+
+// Per-test set up that returns a cleanup function.  This set up:
+// - changes the passphrase retriever to always produce a constant passphrase
+// - disables touch on yubikeys
+// - deletes all keys on the yubikey
+func setUp(t *testing.T) func() {
+	oldRetriever := retriever
+
+	var fake = func(k, a string, c bool, n int) (string, bool, error) {
+		if k == "Yubikey" {
+			return oldRetriever(k, a, c, n)
+		}
+		return testPassphrase, false, nil
+	}
+
+	retriever = fake
+	getRetriever = func() passphrase.Retriever { return fake }
+	api.SetYubikeyKeyMode(api.KeymodeNone)
+
+	// //we're just removing keys here, so nil is fine
+	s, err := api.NewYubiKeyStore(nil, retriever)
+	assert.NoError(t, err)
+	for k := range s.ListKeys() {
+		err := s.RemoveKey(k)
+		assert.NoError(t, err)
+	}
+
+	return func() {
+		retriever = oldRetriever
+		getRetriever = getPassphraseRetriever
+		api.SetYubikeyKeyMode(api.KeymodeTouch | api.KeymodePinOnce)
+	}
+}
+
+// ensures that the root is actually on the yubikey - this makes sure the
+// commands are hooked up to interact with the yubikey, rather than right files
+// on disk
+func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) {
+	// do not bother verifying if there is no yubikey available
+	if api.YubikeyAccessible() {
+		// //we're just getting keys here, so nil is fine
+		s, err := api.NewYubiKeyStore(nil, retriever)
+		assert.NoError(t, err)
+		privKey, role, err := s.GetKey(rootKeyID)
+		assert.NoError(t, err)
+		assert.NotNil(t, privKey)
+		assert.Equal(t, data.CanonicalRootRole, role)
+	}
+}
diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
new file mode 100644
index 0000000000..dd6dec2d41
--- /dev/null
+++ b/cmd/notary/integration_test.go
@@ -0,0 +1,513 @@
+// Actually start up a notary server and run through basic TUF and key
+// interactions via the client.
+
+// Note - if using Yubikey, retrieving pins/touch doesn't seem to work right
+// when running in the midst of all tests.
+
+package main
+
+import (
+	"bytes"
+	"crypto/rand"
+	"io/ioutil"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/Sirupsen/logrus"
+	ctxu "github.com/docker/distribution/context"
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/server"
+	"github.com/docker/notary/server/storage"
+	"github.com/docker/notary/trustmanager"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/context"
+)
+
+var cmd = &cobra.Command{}
+var testPassphrase = "passphrase"
+
+// run a command and return the output as a string
+func runCommand(t *testing.T, tempDir string, args ...string) (string, error) {
+	b := new(bytes.Buffer)
+	cmd.SetArgs(append([]string{"-c", "/tmp/ignore.json", "-d", tempDir}, args...))
+	cmd.SetOutput(b)
+	t.Logf("Running `notary %s`", strings.Join(args, " "))
+
+	retErr := cmd.Execute()
+	output, err := ioutil.ReadAll(b)
+	assert.NoError(t, err)
+	return string(output), retErr
+}
+
+// makes a testing notary-server
+func setupServer() *httptest.Server {
+	// Set up server
+	ctx := context.WithValue(
+		context.Background(), "metaStore", storage.NewMemStorage())
+
+	// Do not pass one of the const KeyAlgorithms here as the value! Passing a
+	// string is in itself good test that we are handling it correctly as we
+	// will be receiving a string from the configuration.
+	ctx = context.WithValue(ctx, "keyAlgorithm", "ecdsa")
+
+	// Eat the logs instead of spewing them out
+	var b bytes.Buffer
+	l := logrus.New()
+	l.Out = &b
+	ctx = ctxu.WithLogger(ctx, logrus.NewEntry(l))
+
+	cryptoService := cryptoservice.NewCryptoService(
+		"", trustmanager.NewKeyMemoryStore(retriever))
+	return httptest.NewServer(server.RootHandler(nil, ctx, cryptoService))
+}
+
+// Initializes a repo, adds a target, publishes the target, lists the target,
+// verifies the target, and then removes the target.
+func TestClientTufInteraction(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	server := setupServer()
+	defer server.Close()
+
+	tempFile, err := ioutil.TempFile("/tmp", "targetfile")
+	assert.NoError(t, err)
+	tempFile.Close()
+	defer os.Remove(tempFile.Name())
+
+	var (
+		output string
+		target = "sdgkadga"
+	)
+	// -- tests --
+
+	// init repo
+	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun")
+	assert.NoError(t, err)
+
+	// add a target
+	_, err = runCommand(t, tempDir, "add", "gun", target, tempFile.Name())
+	assert.NoError(t, err)
+
+	// check status - see target
+	output, err = runCommand(t, tempDir, "status", "gun")
+	assert.NoError(t, err)
+	assert.True(t, strings.Contains(output, target))
+
+	// publish repo
+	_, err = runCommand(t, tempDir, "-s", server.URL, "publish", "gun")
+	assert.NoError(t, err)
+
+	// check status - no targets
+	output, err = runCommand(t, tempDir, "status", "gun")
+	assert.NoError(t, err)
+	assert.False(t, strings.Contains(string(output), target))
+
+	// list repo - see target
+	output, err = runCommand(t, tempDir, "-s", server.URL, "list", "gun")
+	assert.NoError(t, err)
+	assert.True(t, strings.Contains(string(output), target))
+
+	// verify repo - empty file
+	output, err = runCommand(t, tempDir, "verify", "gun", target)
+	assert.NoError(t, err)
+
+	// remove target
+	_, err = runCommand(t, tempDir, "remove", "gun", target)
+	assert.NoError(t, err)
+
+	// publish repo
+	_, err = runCommand(t, tempDir, "-s", server.URL, "publish", "gun")
+	assert.NoError(t, err)
+
+	// list repo - don't see target
+	output, err = runCommand(t, tempDir, "-s", server.URL, "list", "gun")
+	assert.NoError(t, err)
+	assert.False(t, strings.Contains(string(output), target))
+}
+
+// Splits a string into lines, and returns any lines that are not empty (
+// striped of whitespace)
+func splitLines(chunk string) []string {
+	splitted := strings.Split(strings.TrimSpace(chunk), "\n")
+	var results []string
+
+	for _, line := range splitted {
+		line := strings.TrimSpace(line)
+		if line != "" {
+			results = append(results, line)
+		}
+	}
+
+	return results
+}
+
+// List keys, parses the output, and returns the keys as an array of root key
+// IDs and an array of signing key IDs
+func GetKeys(t *testing.T, tempDir string) ([]string, []string) {
+	output, err := runCommand(t, tempDir, "key", "list")
+	assert.NoError(t, err)
+
+	parts := strings.Split(output, "# Signing keys:")
+	assert.Len(t, parts, 2)
+
+	fixed := make([][]string, 2)
+	for i, part := range parts {
+		fixed[i] = splitLines(
+			strings.TrimPrefix(strings.TrimSpace(part), "# Root keys:"))
+		sort.Strings(fixed[i])
+	}
+
+	return fixed[0], fixed[1]
+}
+
+// List keys, parses the output, and asserts something about the number of root
+// keys and number of signing keys, as well as returning them.
+func assertNumKeys(t *testing.T, tempDir string, numRoot, numSigning int) (
+	[]string, []string) {
+
+	root, signing := GetKeys(t, tempDir)
+	assert.Len(t, root, numRoot)
+	assert.Len(t, signing, numSigning)
+	for _, rootKeyID := range root {
+		// it should always be present on disk
+		_, err := os.Stat(filepath.Join(
+			tempDir, "private", "root_keys", rootKeyID+"_root.key"))
+		assert.NoError(t, err)
+
+		// this function is declared is in the build-tagged setup files
+		verifyRootKeyOnHardware(t, rootKeyID)
+	}
+	return root, signing
+}
+
+// Adds the given target to the gun, publishes it, and lists it to ensure that
+// it appears.  Returns the listing output.
+func assertSuccessfullyPublish(
+	t *testing.T, tempDir, url, gun, target, fname string) string {
+
+	_, err := runCommand(t, tempDir, "add", gun, target, fname)
+	assert.NoError(t, err)
+
+	_, err = runCommand(t, tempDir, "-s", url, "publish", gun)
+	assert.NoError(t, err)
+
+	output, err := runCommand(t, tempDir, "-s", url, "list", gun)
+	assert.NoError(t, err)
+	assert.True(t, strings.Contains(string(output), target))
+
+	return output
+}
+
+// Tests root key generation and key rotation
+func TestClientKeyGenerationRotation(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	tempfiles := make([]string, 2)
+	for i := 0; i < 2; i++ {
+		tempFile, err := ioutil.TempFile("/tmp", "targetfile")
+		assert.NoError(t, err)
+		tempFile.Close()
+		tempfiles[i] = tempFile.Name()
+		defer os.Remove(tempFile.Name())
+	}
+
+	server := setupServer()
+	defer server.Close()
+
+	var target = "sdgkadga"
+
+	// -- tests --
+
+	// starts out with no keys
+	assertNumKeys(t, tempDir, 0, 0)
+
+	// generate root key produces a single root key and no other keys
+	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
+	assert.NoError(t, err)
+	assertNumKeys(t, tempDir, 1, 0)
+
+	// initialize a repo, should have signing keys and no new root key
+	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun")
+	assert.NoError(t, err)
+	origRoot, origSign := assertNumKeys(t, tempDir, 1, 2)
+
+	// publish using the original keys
+	assertSuccessfullyPublish(t, tempDir, server.URL, "gun", target, tempfiles[0])
+
+	// rotate the signing keys
+	_, err = runCommand(t, tempDir, "key", "rotate", "gun")
+	assert.NoError(t, err)
+	root, sign := assertNumKeys(t, tempDir, 1, 4)
+	assert.Equal(t, origRoot[0], root[0])
+	// there should be the new keys and the old keys
+	for _, origKey := range origSign {
+		found := false
+		for _, key := range sign {
+			if key == origKey {
+				found = true
+			}
+		}
+		assert.True(t, found, "Old key not found in list of old and new keys")
+	}
+
+	// publish the key rotation
+	_, err = runCommand(t, tempDir, "-s", server.URL, "publish", "gun")
+	assert.NoError(t, err)
+	root, sign = assertNumKeys(t, tempDir, 1, 2)
+	assert.Equal(t, origRoot[0], root[0])
+	// just do a cursory rotation check that the keys aren't equal anymore
+	for _, origKey := range origSign {
+		for _, key := range sign {
+			assert.NotEqual(
+				t, key, origKey, "One of the signing keys was not removed")
+		}
+	}
+
+	// publish using the new keys
+	output := assertSuccessfullyPublish(
+		t, tempDir, server.URL, "gun", target+"2", tempfiles[1])
+	// assert that the previous target is sitll there
+	assert.True(t, strings.Contains(string(output), target))
+}
+
+// Tests import/export root+signing keys - repo with imported keys should be
+// able to publish successfully
+func TestClientKeyImportExportRootAndSigning(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	dirs := make([]string, 3)
+	for i := 0; i < 3; i++ {
+		tempDir, err := ioutil.TempDir("/tmp", "repo")
+		assert.NoError(t, err)
+		defer os.RemoveAll(tempDir)
+		dirs[i] = tempDir
+	}
+
+	tempfiles := make([]string, 2)
+	for i := 0; i < 2; i++ {
+		tempFile, err := ioutil.TempFile("/tmp", "tempfile")
+		assert.NoError(t, err)
+		tempFile.Close()
+		tempfiles[i] = tempFile.Name()
+		defer os.Remove(tempFile.Name())
+	}
+
+	server := setupServer()
+	defer server.Close()
+
+	var (
+		target = "sdgkadga"
+		err    error
+	)
+
+	// create two repos and publish a target
+	for _, gun := range []string{"gun1", "gun2"} {
+		_, err = runCommand(t, dirs[0], "-s", server.URL, "init", gun)
+		assert.NoError(t, err)
+
+		assertSuccessfullyPublish(
+			t, dirs[0], server.URL, gun, target, tempfiles[0])
+	}
+	assertNumKeys(t, dirs[0], 1, 4)
+
+	// -- tests --
+	zipfile := tempfiles[0] + ".zip"
+	defer os.Remove(zipfile)
+
+	// export then import all keys
+	_, err = runCommand(t, dirs[0], "key", "export", zipfile)
+	assert.NoError(t, err)
+
+	_, err = runCommand(t, dirs[1], "key", "import", zipfile)
+	assert.NoError(t, err)
+	assertNumKeys(t, dirs[1], 1, 4) // all keys should be there
+
+	// can list and publish to both repos using imported keys
+	for _, gun := range []string{"gun1", "gun2"} {
+		output, err := runCommand(t, dirs[1], "-s", server.URL, "list", gun)
+		assert.NoError(t, err)
+		assert.True(t, strings.Contains(string(output), target))
+
+		assertSuccessfullyPublish(
+			t, dirs[1], server.URL, gun, target+"2", tempfiles[1])
+	}
+
+	// export then import keys for one gun
+	_, err = runCommand(t, dirs[0], "key", "export", zipfile, "-g", "gun1")
+	assert.NoError(t, err)
+
+	_, err = runCommand(t, dirs[2], "key", "import", zipfile)
+	assert.NoError(t, err)
+
+	// this function is declared is in the build-tagged setup files
+	if rootOnHardware() {
+		// hardware root is still present, but two signing keys moved - we
+		// can't call assertNumKeys, because in this case it will ONLY be on
+		// hardware and not on disk
+		root, signing := GetKeys(t, dirs[2])
+		assert.Len(t, root, 1)
+		verifyRootKeyOnHardware(t, root[0])
+		assert.Len(t, signing, 2)
+	} else {
+		// only 2 signing keys should be there, and no root key
+		assertNumKeys(t, dirs[2], 0, 2)
+	}
+}
+
+// Generate a root key and export the root key only.  Return the key ID
+// exported.
+func exportRoot(t *testing.T, exportTo string) string {
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	// generate root key produces a single root key and no other keys
+	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
+	assert.NoError(t, err)
+	oldRoot, _ := assertNumKeys(t, tempDir, 1, 0)
+
+	// export does not require a password
+	oldRetriever := retriever
+	retriever = nil
+	defer func() { // but import will, later
+		retriever = oldRetriever
+	}()
+
+	_, err = runCommand(
+		t, tempDir, "key", "export-root", oldRoot[0], exportTo)
+	assert.NoError(t, err)
+
+	return oldRoot[0]
+}
+
+// Tests import/export root key only
+func TestClientKeyImportExportRootOnly(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	server := setupServer()
+	defer server.Close()
+
+	var (
+		target    = "sdgkadga"
+		rootKeyID string
+	)
+
+	tempFile, err := ioutil.TempFile("/tmp", "pemfile")
+	assert.NoError(t, err)
+	// close later, because we might need to write to it
+	defer os.Remove(tempFile.Name())
+
+	// -- tests --
+
+	if rootOnHardware() {
+		t.Log("Cannot export a key from hardware. Will generate one to import.")
+
+		privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+		assert.NoError(t, err)
+
+		pemBytes, err := trustmanager.EncryptPrivateKey(privKey, testPassphrase)
+		assert.NoError(t, err)
+
+		nBytes, err := tempFile.Write(pemBytes)
+		assert.NoError(t, err)
+		tempFile.Close()
+		assert.Equal(t, len(pemBytes), nBytes)
+		rootKeyID = privKey.ID()
+	} else {
+		tempFile.Close()
+		rootKeyID = exportRoot(t, tempFile.Name())
+	}
+
+	// import the key
+	_, err = runCommand(t, tempDir, "key", "import-root", tempFile.Name())
+	assert.NoError(t, err)
+	newRoot, _ := assertNumKeys(t, tempDir, 1, 0)
+	assert.Equal(t, rootKeyID, newRoot[0])
+
+	// Just to make sure, init a repo and publish
+	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun")
+	assert.NoError(t, err)
+	assertNumKeys(t, tempDir, 1, 2)
+	assertSuccessfullyPublish(
+		t, tempDir, server.URL, "gun", target, tempFile.Name())
+}
+
+func assertNumCerts(t *testing.T, tempDir string, expectedNum int) []string {
+	output, err := runCommand(t, tempDir, "cert", "list")
+	assert.NoError(t, err)
+	certs := splitLines(
+		strings.TrimPrefix(strings.TrimSpace(output), "# Trusted Certificates:"))
+
+	assert.Len(t, certs, expectedNum)
+	return certs
+}
+
+// TestClientCertInteraction
+func TestClientCertInteraction(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	server := setupServer()
+	defer server.Close()
+
+	// -- tests --
+	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun1")
+	assert.NoError(t, err)
+	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun2")
+	assert.NoError(t, err)
+	certs := assertNumCerts(t, tempDir, 2)
+
+	// remove certs for one gun
+	_, err = runCommand(t, tempDir, "cert", "remove", "-g", "gun1", "-y")
+	assert.NoError(t, err)
+	certs = assertNumCerts(t, tempDir, 1)
+
+	// remove a single cert
+	certID := strings.TrimSpace(strings.Split(certs[0], " ")[1])
+	// passing an empty gun here because the string for the previous gun has
+	// has already been stored (a drawback of running these commands without)
+	// shelling out
+	_, err = runCommand(t, tempDir, "cert", "remove", certID, "-y", "-g", "")
+	assert.NoError(t, err)
+	assertNumCerts(t, tempDir, 0)
+
+}
+
+func TestMain(m *testing.M) {
+	if testing.Short() {
+		// skip
+		os.Exit(0)
+	}
+	setupCommand(cmd)
+	os.Exit(m.Run())
+}
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 7a9c82bbfe..aaf897c7a2 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -2,7 +2,6 @@ package main
 
 import (
 	"archive/zip"
-	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
@@ -11,7 +10,6 @@ import (
 	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 
@@ -116,16 +114,16 @@ func keysList(cmd *cobra.Command, args []string) {
 	// Get a map of all the keys/roles
 	keysMap := cs.ListAllKeys()
 
-	fmt.Println("")
-	fmt.Println("# Root keys: ")
+	cmd.Println("")
+	cmd.Println("# Root keys: ")
 	for k, v := range keysMap {
 		if v == "root" {
-			fmt.Println(k)
+			cmd.Println(k)
 		}
 	}
 
-	fmt.Println("")
-	fmt.Println("# Signing keys: ")
+	cmd.Println("")
+	cmd.Println("# Signing keys: ")
 
 	// Get a list of all the keys
 	var sortedKeys []string
@@ -138,7 +136,7 @@ func keysList(cmd *cobra.Command, args []string) {
 	// Print a sorted list of the key/role
 	for _, k := range sortedKeys {
 		if keysMap[k] != "root" {
-			printKey(k, keysMap[k])
+			printKey(cmd, k, keysMap[k])
 		}
 	}
 }
@@ -180,7 +178,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 		fatalf("failed to create a new root key: %v", err)
 	}
 
-	fmt.Printf("Generated new %s root key with keyID: %s\n", algorithm, pubKey.ID())
+	cmd.Printf("Generated new %s root key with keyID: %s\n", algorithm, pubKey.ID())
 }
 
 // keysExport exports a collection of keys to a ZIP file
@@ -208,7 +206,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	// Must use a different passphrase retriever to avoid caching the
 	// unlocking passphrase and reusing that.
-	exportRetriever := passphrase.PromptRetriever()
+	exportRetriever := getRetriever()
 	if keysExportGUN != "" {
 		err = cs.ExportKeysByGUN(exportFile, keysExportGUN, exportRetriever)
 	} else {
@@ -253,7 +251,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 	if keysExportRootChangePassphrase {
 		// Must use a different passphrase retriever to avoid caching the
 		// unlocking passphrase and reusing that.
-		exportRetriever := passphrase.PromptRetriever()
+		exportRetriever := getRetriever()
 		err = cs.ExportRootKeyReencrypt(exportFile, keyID, exportRetriever)
 	} else {
 		err = cs.ExportRootKey(exportFile, keyID)
@@ -334,10 +332,10 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	}
 }
 
-func printKey(keyPath, alias string) {
+func printKey(cmd *cobra.Command, keyPath, alias string) {
 	keyID := filepath.Base(keyPath)
 	gun := filepath.Dir(keyPath)
-	fmt.Printf("%s - %s - %s\n", gun, alias, keyID)
+	cmd.Printf("%s - %s - %s\n", gun, alias, keyID)
 }
 
 func keysRotate(cmd *cobra.Command, args []string) {
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 668dd2377b..8281af51e3 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -30,6 +30,7 @@ var (
 	configFileName    = "config"
 	configFileExt     = "json"
 	retriever         passphrase.Retriever
+	getRetriever      = getPassphraseRetriever
 	mainViper         = viper.New()
 )
 
@@ -85,13 +86,7 @@ func parseConfig() {
 	}
 }
 
-func main() {
-	var notaryCmd = &cobra.Command{
-		Use:   "notary",
-		Short: "notary allows the creation of trusted collections.",
-		Long:  "notary allows the creation and management of collections of signed targets, allowing the signing and validation of arbitrary content.",
-	}
-
+func setupCommand(notaryCmd *cobra.Command) {
 	var versionCmd = &cobra.Command{
 		Use:   "version",
 		Short: "Print the version number of notary",
@@ -124,7 +119,15 @@ func main() {
 	cmdTufLookup.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 	notaryCmd.AddCommand(cmdVerify)
 	cmdVerify.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
+}
 
+func main() {
+	var notaryCmd = &cobra.Command{
+		Use:   "notary",
+		Short: "notary allows the creation of trusted collections.",
+		Long:  "notary allows the creation and management of collections of signed targets, allowing the signing and validation of arbitrary content.",
+	}
+	setupCommand(notaryCmd)
 	notaryCmd.Execute()
 }
 
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index 6faf590002..c835351a96 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -107,7 +107,7 @@ func tufAdd(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf(err.Error())
 	}
-	fmt.Printf("Addition of %s to %s staged for next publish.\n", targetName, gun)
+	cmd.Printf("Addition of %s to %s staged for next publish.\n", targetName, gun)
 }
 
 func tufInit(cmd *cobra.Command, args []string) {
@@ -128,7 +128,7 @@ func tufInit(cmd *cobra.Command, args []string) {
 
 	var rootKeyID string
 	if len(rootKeyList) < 1 {
-		fmt.Println("No root keys found. Generating a new root key...")
+		cmd.Println("No root keys found. Generating a new root key...")
 		rootPublicKey, err := nRepo.CryptoService.Create(data.CanonicalRootRole, data.ECDSAKey)
 		rootKeyID = rootPublicKey.ID()
 		if err != nil {
@@ -138,7 +138,7 @@ func tufInit(cmd *cobra.Command, args []string) {
 		// Choses the first root key available, which is initialization specific
 		// but should return the HW one first.
 		rootKeyID = rootKeyList[0]
-		fmt.Printf("Root key found, using: %s\n", rootKeyID)
+		cmd.Printf("Root key found, using: %s\n", rootKeyID)
 	}
 
 	err = nRepo.Initialize(rootKeyID)
@@ -168,7 +168,7 @@ func tufList(cmd *cobra.Command, args []string) {
 
 	// Print all the available targets
 	for _, t := range targetList {
-		fmt.Printf("%s %x %d\n", t.Name, t.Hashes["sha256"], t.Length)
+		cmd.Printf("%s %x %d\n", t.Name, t.Hashes["sha256"], t.Length)
 	}
 }
 
@@ -191,7 +191,7 @@ func tufLookup(cmd *cobra.Command, args []string) {
 		fatalf(err.Error())
 	}
 
-	fmt.Println(target.Name, fmt.Sprintf("sha256:%x", target.Hashes["sha256"]), target.Length)
+	cmd.Println(target.Name, fmt.Sprintf("sha256:%x", target.Hashes["sha256"]), target.Length)
 }
 
 func tufStatus(cmd *cobra.Command, args []string) {
@@ -214,15 +214,15 @@ func tufStatus(cmd *cobra.Command, args []string) {
 	}
 
 	if len(cl.List()) == 0 {
-		fmt.Printf("No unpublished changes for %s\n", gun)
+		cmd.Printf("No unpublished changes for %s\n", gun)
 		return
 	}
 
-	fmt.Printf("Unpublished changes for %s:\n\n", gun)
-	fmt.Printf("%-10s%-10s%-12s%s\n", "action", "scope", "type", "path")
-	fmt.Println("----------------------------------------------------")
+	cmd.Printf("Unpublished changes for %s:\n\n", gun)
+	cmd.Printf("%-10s%-10s%-12s%s\n", "action", "scope", "type", "path")
+	cmd.Println("----------------------------------------------------")
 	for _, ch := range cl.List() {
-		fmt.Printf("%-10s%-10s%-12s%s\n", ch.Action(), ch.Scope(), ch.Type(), ch.Path())
+		cmd.Printf("%-10s%-10s%-12s%s\n", ch.Action(), ch.Scope(), ch.Type(), ch.Path())
 	}
 }
 
@@ -235,7 +235,7 @@ func tufPublish(cmd *cobra.Command, args []string) {
 	gun := args[0]
 	parseConfig()
 
-	fmt.Println("Pushing changes to ", gun, ".")
+	cmd.Println("Pushing changes to", gun)
 
 	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
 	if err != nil {
@@ -268,7 +268,7 @@ func tufRemove(cmd *cobra.Command, args []string) {
 		fatalf(err.Error())
 	}
 
-	fmt.Printf("Removal of %s from %s staged for next publish.\n", targetName, gun)
+	cmd.Printf("Removal of %s from %s staged for next publish.\n", targetName, gun)
 }
 
 func verify(cmd *cobra.Command, args []string) {
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 0ef0c0a8b6..95d13c0de2 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -25,8 +25,29 @@ const (
 	USER_PIN    = "123456"
 	SO_USER_PIN = "010203040506070801020304050607080102030405060708"
 	numSlots    = 4 // number of slots in the yubikey
+
+	KeymodeNone      = 0
+	KeymodeTouch     = 1 // touch enabled
+	KeymodePinOnce   = 2 // require pin entry once
+	KeymodePinAlways = 4 // require pin entry all the time
 )
 
+// what key mode to use when generating keys
+var yubikeyKeymode = KeymodeTouch | KeymodePinOnce
+
+// SetYubikeyKeyMode - sets the mode when generating yubikey keys.
+// This is to be used for testing.  It does nothing if not building with tag
+// pkcs11.
+func SetYubikeyKeyMode(keyMode int) error {
+	// technically 7 (1 | 2 | 4) is valid, but KeymodePinOnce +
+	// KeymdoePinAlways don't really make sense together
+	if keyMode < 0 || keyMode > 5 {
+		return errors.New("Invalid key mode")
+	}
+	yubikeyKeymode = keyMode
+	return nil
+}
+
 // Hardcoded yubikey PKCS11 ID
 var YUBIKEY_ROOT_KEY_ID = []byte{2}
 
@@ -153,10 +174,7 @@ func addECDSAKey(
 		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
 		pkcs11.NewAttribute(pkcs11.CKA_EC_PARAMS, []byte{0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07}),
 		pkcs11.NewAttribute(pkcs11.CKA_VALUE, ecdsaPrivKeyD),
-		// 1 is touch enabled
-		// 2 is pin once
-		// 4 is pin always
-		pkcs11.NewAttribute(pkcs11.CKA_VENDOR_DEFINED, 3),
+		pkcs11.NewAttribute(pkcs11.CKA_VENDOR_DEFINED, yubikeyKeymode),
 	}
 
 	_, err = ctx.CreateObject(session, certTemplate)
@@ -641,6 +659,16 @@ func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error)
 	return p, session, nil
 }
 
+// YubikeyEnabled returns true if a Yubikey can be accessed
+func YubikeyAccessible() bool {
+	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	if err != nil {
+		return false
+	}
+	defer cleanup(ctx, session)
+	return true
+}
+
 func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphrase.Retriever, userFlag uint, defaultPassw string) error {
 	// try default password
 	err := ctx.Login(session, userFlag, defaultPassw)

From e4e099ae00c628e059a23877f5dfd804e3e509d3 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 22:04:23 -0800
Subject: [PATCH 38/85] Just ignore the `-s` notary CLI option instead of
 erroring.

Currently commands that do not require online access will error if
this option is passed.  Do not error anymore, just ignore.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/main.go | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 8281af51e3..81c76f538d 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -101,24 +101,20 @@ func setupCommand(notaryCmd *cobra.Command) {
 	notaryCmd.PersistentFlags().StringVarP(&trustDir, "trustdir", "d", "", "directory where the trust data is persisted to")
 	notaryCmd.PersistentFlags().StringVarP(&configFile, "configFile", "c", "", "path to the configuration file to use")
 	notaryCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "verbose output")
+	notaryCmd.PersistentFlags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 
 	notaryCmd.AddCommand(cmdKey)
 	notaryCmd.AddCommand(cmdCert)
 	notaryCmd.AddCommand(cmdTufInit)
-	cmdTufInit.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 	notaryCmd.AddCommand(cmdTufList)
 	cmdTufList.Flags().BoolVarP(&rawOutput, "raw", "", false, "Instructs notary list to output a nonpretty printed version of the targets list. Useful if you need to parse the list.")
-	cmdTufList.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 	notaryCmd.AddCommand(cmdTufAdd)
 	notaryCmd.AddCommand(cmdTufRemove)
 	notaryCmd.AddCommand(cmdTufStatus)
 	notaryCmd.AddCommand(cmdTufPublish)
-	cmdTufPublish.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 	notaryCmd.AddCommand(cmdTufLookup)
 	cmdTufLookup.Flags().BoolVarP(&rawOutput, "raw", "", false, "Instructs notary lookup to output a nonpretty printed version of the targets list. Useful if you need to parse the list.")
-	cmdTufLookup.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 	notaryCmd.AddCommand(cmdVerify)
-	cmdVerify.Flags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 }
 
 func main() {

From 313ae803456753cd7e2821693a07b345b41dccca Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 22:06:11 -0800
Subject: [PATCH 39/85] Remove unused rawOutput option in notary CLI.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/main.go | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 81c76f538d..9489d55f14 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -21,7 +21,6 @@ const (
 )
 
 var (
-	rawOutput         bool
 	verbose           bool
 	trustDir          string
 	configFile        string
@@ -107,13 +106,11 @@ func setupCommand(notaryCmd *cobra.Command) {
 	notaryCmd.AddCommand(cmdCert)
 	notaryCmd.AddCommand(cmdTufInit)
 	notaryCmd.AddCommand(cmdTufList)
-	cmdTufList.Flags().BoolVarP(&rawOutput, "raw", "", false, "Instructs notary list to output a nonpretty printed version of the targets list. Useful if you need to parse the list.")
 	notaryCmd.AddCommand(cmdTufAdd)
 	notaryCmd.AddCommand(cmdTufRemove)
 	notaryCmd.AddCommand(cmdTufStatus)
 	notaryCmd.AddCommand(cmdTufPublish)
 	notaryCmd.AddCommand(cmdTufLookup)
-	cmdTufLookup.Flags().BoolVarP(&rawOutput, "raw", "", false, "Instructs notary lookup to output a nonpretty printed version of the targets list. Useful if you need to parse the list.")
 	notaryCmd.AddCommand(cmdVerify)
 }
 

From 087f13ae7d513735f2fda9017ac207d9ef1d1bfb Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 22:41:47 -0800
Subject: [PATCH 40/85] Normalize and elaborate on the command line help.

Ensures that the notary command line help text start with capital
letters, and add information about hardware keys and online/offline operation.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/cert.go | 26 +++++++++---------
 cmd/notary/keys.go | 68 +++++++++++++++++++++++-----------------------
 cmd/notary/main.go | 16 +++++------
 cmd/notary/tuf.go  | 52 ++++++++++++++++++-----------------
 4 files changed, 82 insertions(+), 80 deletions(-)

diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index 2e4789177d..9ed6937724 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -25,13 +25,13 @@ func init() {
 var cmdCert = &cobra.Command{
 	Use:   "cert",
 	Short: "Operates on certificates.",
-	Long:  `operations on certificates.`,
+	Long:  `Operations on certificates.`,
 }
 
 var cmdCertList = &cobra.Command{
 	Use:   "list",
 	Short: "Lists certificates.",
-	Long:  "lists root certificates known to notary.",
+	Long:  "Lists root certificates known to notary.",
 	Run:   certList,
 }
 
@@ -41,7 +41,7 @@ var certRemoveYes bool
 var cmdCertRemove = &cobra.Command{
 	Use:   "remove [ certID ]",
 	Short: "Removes the certificate with the given cert ID.",
-	Long:  "remove the certificate with the given cert ID from the local host.",
+	Long:  "Remove the certificate with the given cert ID from the local host.",
 	Run:   certRemove,
 }
 
@@ -51,7 +51,7 @@ func certRemove(cmd *cobra.Command, args []string) {
 	// If the user provided -g and a cert ID, also show usage
 	if (len(args) < 1 && certRemoveGUN == "") || (len(args) > 0 && certRemoveGUN != "") {
 		cmd.Usage()
-		fatalf("must specify the cert ID or the GUN of the certificates to remove")
+		fatalf("Must specify the cert ID or the GUN of the certificates to remove")
 	}
 
 	parseConfig()
@@ -59,11 +59,11 @@ func certRemove(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
+		fatalf("Failed to create a new truststore manager with directory: %s", trustDir)
 	}
 
 	var certsToRemove []*x509.Certificate
@@ -73,12 +73,12 @@ func certRemove(cmd *cobra.Command, args []string) {
 		certID := args[0]
 		// This is an invalid ID
 		if len(certID) != idSize {
-			fatalf("invalid certificate ID provided: %s", certID)
+			fatalf("Invalid certificate ID provided: %s", certID)
 		}
 		// Attempt to find this certificates
 		cert, err := keyStoreManager.TrustedCertificateStore().GetCertificateByCertID(certID)
 		if err != nil {
-			fatalf("unable to retrieve certificate with cert ID: %s", certID)
+			fatalf("Unable to retrieve certificate with cert ID: %s", certID)
 		}
 		certsToRemove = append(certsToRemove, cert)
 	} else {
@@ -104,7 +104,7 @@ func certRemove(cmd *cobra.Command, args []string) {
 	if !certRemoveYes {
 		confirmed := askConfirm()
 		if !confirmed {
-			fatalf("aborting action.")
+			fatalf("Aborting action.")
 		}
 	}
 
@@ -112,7 +112,7 @@ func certRemove(cmd *cobra.Command, args []string) {
 	for _, cert := range certsToRemove {
 		err = keyStoreManager.TrustedCertificateStore().RemoveCert(cert)
 		if err != nil {
-			fatalf("failed to remove root certificate for %s", cert.Subject.CommonName)
+			fatalf("Failed to remove root certificate for %s", cert.Subject.CommonName)
 		}
 	}
 }
@@ -128,11 +128,11 @@ func certList(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
-		fatalf("failed to create a new truststore manager with directory: %s", trustDir)
+		fatalf("Failed to create a new truststore manager with directory: %s", trustDir)
 	}
 
 	cmd.Println("")
@@ -147,7 +147,7 @@ func printCert(cmd *cobra.Command, cert *x509.Certificate) {
 	timeDifference := cert.NotAfter.Sub(time.Now())
 	certID, err := trustmanager.FingerprintCert(cert)
 	if err != nil {
-		fatalf("could not fingerprint certificate: %v", err)
+		fatalf("Could not fingerprint certificate: %v", err)
 	}
 
 	cmd.Printf("%s %s (expires in: %v days)\n", cert.Subject.CommonName, certID, math.Floor(timeDifference.Hours()/24))
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index aaf897c7a2..72d11b1a3d 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -22,10 +22,10 @@ func init() {
 	cmdKey.AddCommand(cmdKeyList)
 	cmdKey.AddCommand(cmdKeyGenerateRootKey)
 
-	cmdKeyExport.Flags().StringVarP(&keysExportGUN, "gun", "g", "", "Globally unique name to export keys for")
+	cmdKeyExport.Flags().StringVarP(&keysExportGUN, "gun", "g", "", "Globally Unique Name to export keys for")
 	cmdKey.AddCommand(cmdKeyExport)
 	cmdKey.AddCommand(cmdKeyExportRoot)
-	cmdKeyExportRoot.Flags().BoolVarP(&keysExportRootChangePassphrase, "change-passphrase", "p", false, "set a new passphrase for the key being exported")
+	cmdKeyExportRoot.Flags().BoolVarP(&keysExportRootChangePassphrase, "change-passphrase", "p", false, "Set a new passphrase for the key being exported")
 	cmdKey.AddCommand(cmdKeyImport)
 	cmdKey.AddCommand(cmdKeyImportRoot)
 	cmdKey.AddCommand(cmdRotateKey)
@@ -34,27 +34,27 @@ func init() {
 var cmdKey = &cobra.Command{
 	Use:   "key",
 	Short: "Operates on keys.",
-	Long:  `operations on private keys.`,
+	Long:  `Operations on private keys.`,
 }
 
 var cmdKeyList = &cobra.Command{
 	Use:   "list",
 	Short: "Lists keys.",
-	Long:  "lists keys known to notary.",
+	Long:  "Lists all keys known to notary.",
 	Run:   keysList,
 }
 
 var cmdRotateKey = &cobra.Command{
 	Use:   "rotate [ GUN ]",
-	Short: "Rotate all keys for role.",
-	Long:  "Removes all old keys for the given role and generates 1 new key.",
+	Short: "Rotate all the signing (non-root) keys for the given Globally Unique Name.",
+	Long:  "Removes all old signing (non-root) keys for the given Globally Unique Name, and generates new ones.  This only makes local changes - please use then `notary publish` to push the key rotation changes to the remote server.",
 	Run:   keysRotate,
 }
 
 var cmdKeyGenerateRootKey = &cobra.Command{
 	Use:   "generate [ algorithm ]",
 	Short: "Generates a new root key with a given algorithm.",
-	Long:  "generates a new root key with a given algorithm.",
+	Long:  "Generates a new root key with a given algorithm. If a hardware smartcard is available, the key will be stored both on hardware and on disk.  Please make sure to back up the key that is written to disk, and to then take the on-disk key offline.",
 	Run:   keysGenerateRootKey,
 }
 
@@ -63,7 +63,7 @@ var keysExportGUN string
 var cmdKeyExport = &cobra.Command{
 	Use:   "export [ filename ]",
 	Short: "Exports keys to a ZIP file.",
-	Long:  "exports a collection of keys. The keys are reencrypted with a new passphrase. The output is a ZIP file.",
+	Long:  "Exports a collection of keys. The keys are reencrypted with a new passphrase. The output is a ZIP file.  If the --gun option is passed, only signing keys and no root keys will be exported.  Does not work on keys that are only in hardware (smartcards).",
 	Run:   keysExport,
 }
 
@@ -72,21 +72,21 @@ var keysExportRootChangePassphrase bool
 var cmdKeyExportRoot = &cobra.Command{
 	Use:   "export-root [ keyID ] [ filename ]",
 	Short: "Exports given root key to a file.",
-	Long:  "exports a root key, without reencrypting. The output is a PEM file.",
+	Long:  "Exports a root key, without reencrypting. The output is a PEM file. Does not work on keys that are only in hardware (smartcards).",
 	Run:   keysExportRoot,
 }
 
 var cmdKeyImport = &cobra.Command{
 	Use:   "import [ filename ]",
 	Short: "Imports keys from a ZIP file.",
-	Long:  "imports one or more keys from a ZIP file.",
+	Long:  "Imports one or more keys from a ZIP file. If a hardware smartcard is available, the root key will be imported into the smartcard but not to disk.",
 	Run:   keysImport,
 }
 
 var cmdKeyImportRoot = &cobra.Command{
 	Use:   "import-root [ filename ]",
 	Short: "Imports root key.",
-	Long:  "imports a root key from a PEM file.",
+	Long:  "Imports a root key from a PEM file. If a hardware smartcard is available, the root key will be imported into the smartcard but not to disk.",
 	Run:   keysImportRoot,
 }
 
@@ -101,7 +101,7 @@ func keysList(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	yubiStore, _ := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
@@ -144,7 +144,7 @@ func keysList(cmd *cobra.Command, args []string) {
 func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	if len(args) < 1 {
 		cmd.Usage()
-		fatalf("must specify an Algorithm (RSA, ECDSA)")
+		fatalf("Must specify an Algorithm (RSA, ECDSA)")
 	}
 
 	algorithm := args[0]
@@ -154,7 +154,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	}
 
 	if !allowedCiphers[strings.ToLower(algorithm)] {
-		fatalf("algorithm not allowed, possible values are: RSA, ECDSA")
+		fatalf("Algorithm not allowed, possible values are: RSA, ECDSA")
 	}
 
 	parseConfig()
@@ -162,7 +162,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
@@ -175,7 +175,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
 	if err != nil {
-		fatalf("failed to create a new root key: %v", err)
+		fatalf("Failed to create a new root key: %v", err)
 	}
 
 	cmd.Printf("Generated new %s root key with keyID: %s\n", algorithm, pubKey.ID())
@@ -185,7 +185,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 func keysExport(cmd *cobra.Command, args []string) {
 	if len(args) < 1 {
 		cmd.Usage()
-		fatalf("must specify output filename for export")
+		fatalf("Must specify output filename for export")
 	}
 
 	exportFilename := args[0]
@@ -195,13 +195,13 @@ func keysExport(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
-		fatalf("error creating output file: %v", err)
+		fatalf("Error creating output file: %v", err)
 	}
 
 	// Must use a different passphrase retriever to avoid caching the
@@ -217,7 +217,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	if err != nil {
 		os.Remove(exportFilename)
-		fatalf("error exporting keys: %v", err)
+		fatalf("Error exporting keys: %v", err)
 	}
 }
 
@@ -225,14 +225,14 @@ func keysExport(cmd *cobra.Command, args []string) {
 func keysExportRoot(cmd *cobra.Command, args []string) {
 	if len(args) < 2 {
 		cmd.Usage()
-		fatalf("must specify key ID and output filename for export")
+		fatalf("Must specify key ID and output filename for export")
 	}
 
 	keyID := args[0]
 	exportFilename := args[1]
 
 	if len(keyID) != idSize {
-		fatalf("please specify a valid root key ID")
+		fatalf("Please specify a valid root key ID")
 	}
 
 	parseConfig()
@@ -240,13 +240,13 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
-		fatalf("error creating output file: %v", err)
+		fatalf("Error creating output file: %v", err)
 	}
 	if keysExportRootChangePassphrase {
 		// Must use a different passphrase retriever to avoid caching the
@@ -259,7 +259,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 	exportFile.Close()
 	if err != nil {
 		os.Remove(exportFilename)
-		fatalf("error exporting root key: %v", err)
+		fatalf("Error exporting root key: %v", err)
 	}
 }
 
@@ -267,7 +267,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 func keysImport(cmd *cobra.Command, args []string) {
 	if len(args) < 1 {
 		cmd.Usage()
-		fatalf("must specify input filename for import")
+		fatalf("Must specify input filename for import")
 	}
 
 	importFilename := args[0]
@@ -277,20 +277,20 @@ func keysImport(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	cs := cryptoservice.NewCryptoService("", fileKeyStore)
 
 	zipReader, err := zip.OpenReader(importFilename)
 	if err != nil {
-		fatalf("opening file for import: %v", err)
+		fatalf("Opening file for import: %v", err)
 	}
 	defer zipReader.Close()
 
 	err = cs.ImportKeysZip(zipReader.Reader)
 
 	if err != nil {
-		fatalf("error importing keys: %v", err)
+		fatalf("Error importing keys: %v", err)
 	}
 }
 
@@ -298,7 +298,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 func keysImportRoot(cmd *cobra.Command, args []string) {
 	if len(args) != 1 {
 		cmd.Usage()
-		fatalf("must specify input filename for import")
+		fatalf("Must specify input filename for import")
 	}
 
 	importFilename := args[0]
@@ -308,7 +308,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
-		fatalf("failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", keysPath)
 	}
 	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
 	var cs signed.CryptoService
@@ -321,14 +321,14 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
-		fatalf("opening file for import: %v", err)
+		fatalf("Opening file for import: %v", err)
 	}
 	defer importFile.Close()
 
 	err = cs.ImportRootKey(importFile)
 
 	if err != nil {
-		fatalf("error importing root key: %v", err)
+		fatalf("Error importing root key: %v", err)
 	}
 }
 
@@ -341,7 +341,7 @@ func printKey(cmd *cobra.Command, keyPath, alias string) {
 func keysRotate(cmd *cobra.Command, args []string) {
 	if len(args) < 1 {
 		cmd.Usage()
-		fatalf("must specify a GUN and target")
+		fatalf("Must specify a GUN and target")
 	}
 	parseConfig()
 
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 9489d55f14..da2176188c 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -47,10 +47,10 @@ func parseConfig() {
 		// Get home directory for current user
 		homeDir, err := homedir.Dir()
 		if err != nil {
-			fatalf("cannot get current user home directory: %v", err)
+			fatalf("Cannot get current user home directory: %v", err)
 		}
 		if homeDir == "" {
-			fatalf("cannot get current user home directory")
+			fatalf("Cannot get current user home directory")
 		}
 		trustDir = filepath.Join(homeDir, filepath.Dir(configDir))
 
@@ -80,7 +80,7 @@ func parseConfig() {
 		logrus.Debugf("configuration file not found, using defaults")
 		// Ignore if the configuration file doesn't exist, we can use the defaults
 		if !os.IsNotExist(err) {
-			fatalf("fatal error config file: %v", err)
+			fatalf("Fatal error config file: %v", err)
 		}
 	}
 }
@@ -97,9 +97,9 @@ func setupCommand(notaryCmd *cobra.Command) {
 
 	notaryCmd.AddCommand(versionCmd)
 
-	notaryCmd.PersistentFlags().StringVarP(&trustDir, "trustdir", "d", "", "directory where the trust data is persisted to")
-	notaryCmd.PersistentFlags().StringVarP(&configFile, "configFile", "c", "", "path to the configuration file to use")
-	notaryCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "verbose output")
+	notaryCmd.PersistentFlags().StringVarP(&trustDir, "trustdir", "d", "", "Directory where the trust data is persisted to")
+	notaryCmd.PersistentFlags().StringVarP(&configFile, "configFile", "c", "", "Path to the configuration file to use")
+	notaryCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "Verbose output")
 	notaryCmd.PersistentFlags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
 
 	notaryCmd.AddCommand(cmdKey)
@@ -117,8 +117,8 @@ func setupCommand(notaryCmd *cobra.Command) {
 func main() {
 	var notaryCmd = &cobra.Command{
 		Use:   "notary",
-		Short: "notary allows the creation of trusted collections.",
-		Long:  "notary allows the creation and management of collections of signed targets, allowing the signing and validation of arbitrary content.",
+		Short: "Notary allows the creation of trusted collections.",
+		Long:  "Notary allows the creation and management of collections of signed targets, allowing the signing and validation of arbitrary content.",
 	}
 	setupCommand(notaryCmd)
 	notaryCmd.Execute()
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index c835351a96..16b6ef57d7 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -27,64 +27,64 @@ import (
 
 var cmdTufList = &cobra.Command{
 	Use:   "list [ GUN ]",
-	Short: "Lists targets for a trusted collection.",
-	Long:  "Lists all targets for a trusted collection identified by the Globally Unique Name.",
+	Short: "Lists targets for a remote trusted collection.",
+	Long:  "Lists all targets for a remote trusted collection identified by the Globally Unique Name. This is an online operation.",
 	Run:   tufList,
 }
 
 var cmdTufAdd = &cobra.Command{
 	Use:   "add [ GUN ] <target> <file>",
-	Short: "adds the file as a target to the trusted collection.",
-	Long:  "adds the file as a target to the local trusted collection identified by the Globally Unique Name.",
+	Short: "Adds the file as a target to the trusted collection.",
+	Long:  "Adds the file as a target to the local trusted collection identified by the Globally Unique Name. This is an offline operation.  Please then use `publish` to push the changes to the remote trusted collection.",
 	Run:   tufAdd,
 }
 
 var cmdTufRemove = &cobra.Command{
 	Use:   "remove [ GUN ] <target>",
 	Short: "Removes a target from a trusted collection.",
-	Long:  "removes a target from the local trusted collection identified by the Globally Unique Name.",
+	Long:  "Removes a target from the local trusted collection identified by the Globally Unique Name. This is an offline operation.  Please then use `publish` to push the changes to the remote trusted collection.",
 	Run:   tufRemove,
 }
 
 var cmdTufInit = &cobra.Command{
 	Use:   "init [ GUN ]",
-	Short: "initializes a local trusted collection.",
-	Long:  "initializes a local trusted collection identified by the Globally Unique Name.",
+	Short: "Initializes a local trusted collection.",
+	Long:  "Initializes a local trusted collection identified by the Globally Unique Name. This is an online operation.",
 	Run:   tufInit,
 }
 
 var cmdTufLookup = &cobra.Command{
 	Use:   "lookup [ GUN ] <target>",
-	Short: "Looks up a specific target in a trusted collection.",
-	Long:  "looks up a specific target in a trusted collection identified by the Globally Unique Name.",
+	Short: "Looks up a specific target in a remote trusted collection.",
+	Long:  "Looks up a specific target in a remote trusted collection identified by the Globally Unique Name.",
 	Run:   tufLookup,
 }
 
 var cmdTufPublish = &cobra.Command{
 	Use:   "publish [ GUN ]",
-	Short: "publishes the local trusted collection.",
-	Long:  "publishes the local trusted collection identified by the Globally Unique Name, sending the local changes to a remote trusted server.",
+	Short: "Publishes the local trusted collection.",
+	Long:  "Publishes the local trusted collection identified by the Globally Unique Name, sending the local changes to a remote trusted server.",
 	Run:   tufPublish,
 }
 
 var cmdTufStatus = &cobra.Command{
 	Use:   "status [ GUN ]",
-	Short: "displays status of unpublished changes to the local trusted collection.",
-	Long:  "displays status of unpublished changes to the local trusted collection identified by the Globally Unique Name.",
+	Short: "Displays status of unpublished changes to the local trusted collection.",
+	Long:  "Displays status of unpublished changes to the local trusted collection identified by the Globally Unique Name.",
 	Run:   tufStatus,
 }
 
 var cmdVerify = &cobra.Command{
 	Use:   "verify [ GUN ] <target>",
-	Short: "verifies if the content is included in the trusted collection",
-	Long:  "verifies if the data passed in STDIN is included in the trusted collection identified by the Global Unique Name.",
+	Short: "Verifies if the content is included in the remote trusted collection",
+	Long:  "Verifies if the data passed in STDIN is included in the remote trusted collection identified by the Global Unique Name.",
 	Run:   verify,
 }
 
 func tufAdd(cmd *cobra.Command, args []string) {
 	if len(args) < 3 {
 		cmd.Usage()
-		fatalf("must specify a GUN, target, and path to target data")
+		fatalf("Must specify a GUN, target, and path to target data")
 	}
 
 	gun := args[0]
@@ -107,7 +107,9 @@ func tufAdd(cmd *cobra.Command, args []string) {
 	if err != nil {
 		fatalf(err.Error())
 	}
-	cmd.Printf("Addition of %s to %s staged for next publish.\n", targetName, gun)
+	cmd.Printf(
+		"Addition of target \"%s\" to repository \"%s\" staged for next publish.\n",
+		targetName, gun)
 }
 
 func tufInit(cmd *cobra.Command, args []string) {
@@ -150,7 +152,7 @@ func tufInit(cmd *cobra.Command, args []string) {
 func tufList(cmd *cobra.Command, args []string) {
 	if len(args) < 1 {
 		cmd.Usage()
-		fatalf("must specify a GUN")
+		fatalf("Must specify a GUN")
 	}
 	gun := args[0]
 	parseConfig()
@@ -175,7 +177,7 @@ func tufList(cmd *cobra.Command, args []string) {
 func tufLookup(cmd *cobra.Command, args []string) {
 	if len(args) < 2 {
 		cmd.Usage()
-		fatalf("must specify a GUN and target")
+		fatalf("Must specify a GUN and target")
 	}
 	gun := args[0]
 	targetName := args[1]
@@ -251,7 +253,7 @@ func tufPublish(cmd *cobra.Command, args []string) {
 func tufRemove(cmd *cobra.Command, args []string) {
 	if len(args) < 2 {
 		cmd.Usage()
-		fatalf("must specify a GUN and target")
+		fatalf("Must specify a GUN and target")
 	}
 	gun := args[0]
 	targetName := args[1]
@@ -274,14 +276,14 @@ func tufRemove(cmd *cobra.Command, args []string) {
 func verify(cmd *cobra.Command, args []string) {
 	if len(args) < 2 {
 		cmd.Usage()
-		fatalf("must specify a GUN and target")
+		fatalf("Must specify a GUN and target")
 	}
 	parseConfig()
 
 	// Reads all of the data on STDIN
 	payload, err := ioutil.ReadAll(os.Stdin)
 	if err != nil {
-		fatalf("error reading content from STDIN: %v", err)
+		fatalf("Error reading content from STDIN: %v", err)
 	}
 
 	gun := args[0]
@@ -399,14 +401,14 @@ func tokenAuth(baseTransport *http.Transport, gun string, readOnly bool) http.Ro
 	trustServerURL := getRemoteTrustServer()
 	endpoint, err := url.Parse(trustServerURL)
 	if err != nil {
-		fatalf("could not parse remote trust server url (%s): %s", trustServerURL, err.Error())
+		fatalf("Could not parse remote trust server url (%s): %s", trustServerURL, err.Error())
 	}
 	if endpoint.Scheme == "" {
-		fatalf("trust server url has to be in the form of http(s)://URL:PORT. Got: %s", trustServerURL)
+		fatalf("Trust server url has to be in the form of http(s)://URL:PORT. Got: %s", trustServerURL)
 	}
 	subPath, err := url.Parse("v2/")
 	if err != nil {
-		fatalf("failed to parse v2 subpath. This error should not have been reached. Please report it as an issue at https://github.com/docker/notary/issues: %s", err.Error())
+		fatalf("Failed to parse v2 subpath. This error should not have been reached. Please report it as an issue at https://github.com/docker/notary/issues: %s", err.Error())
 	}
 	endpoint = endpoint.ResolveReference(subPath)
 	req, err := http.NewRequest("GET", endpoint.String(), nil)

From 14c5d2e05a3871bd10aad405b802edc1a240e75f Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 23:26:01 -0800
Subject: [PATCH 41/85] Normalize how the key IDs are displayed in the password
 prompts.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 passphrase/passphrase.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/passphrase/passphrase.go b/passphrase/passphrase.go
index 6381b2af09..777de63721 100644
--- a/passphrase/passphrase.go
+++ b/passphrase/passphrase.go
@@ -118,18 +118,18 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 			if indexOfLastSeparator > 0 {
 				keyNamePrefix := keyName[:indexOfLastSeparator]
 				keyNameID := keyName[indexOfLastSeparator+1 : indexOfLastSeparator+idBytesToDisplay+1]
-				shortName = keyNamePrefix + " (" + keyNameID + ")"
+				shortName = keyNameID + " (" + keyNamePrefix + ")"
 			} else {
 				shortName = keyName[indexOfLastSeparator : indexOfLastSeparator+idBytesToDisplay]
 			}
 		}
 
 		if createNew {
-			fmt.Fprintf(out, "Enter passphrase for new %s key with id %s: ", displayAlias, shortName)
+			fmt.Fprintf(out, "Enter passphrase for new %s key with ID %s: ", displayAlias, shortName)
 		} else if displayAlias == "yubikey" {
 			fmt.Fprintf(out, "Enter the %s for the attached Yubikey: ", keyName)
 		} else {
-			fmt.Fprintf(out, "Enter passphrase for %s key with id %s: ", displayAlias, shortName)
+			fmt.Fprintf(out, "Enter passphrase for %s key with ID %s: ", displayAlias, shortName)
 		}
 
 		passphrase, err := stdin.ReadBytes('\n')
@@ -157,7 +157,7 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 			return "", false, ErrTooShort
 		}
 
-		fmt.Fprintf(out, "Repeat passphrase for new %s key with id %s: ", displayAlias, keyName)
+		fmt.Fprintf(out, "Repeat passphrase for new %s key with ID %s: ", displayAlias, shortName)
 		confirmation, err := stdin.ReadBytes('\n')
 		fmt.Fprintln(out)
 		if err != nil {

From 4867410e989606a20c46c9e51c32946ef63e83c2 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 21:17:40 -0800
Subject: [PATCH 42/85] Ensure that tests pass and binaries build without the
 pkcs11 build tag.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/keys.go            | 67 +++----------------------------
 cmd/notary/keys_nonpkcs11.go  | 24 ++++++++++++
 cmd/notary/keys_pkcs11.go     | 41 +++++++++++++++++++
 signer/api/api_pkcs11_test.go | 74 +++++++++++++++++++++++++++++++++++
 signer/api/api_test.go        | 64 ------------------------------
 signer/keys/keys.go           | 55 +-------------------------
 signer/keys/keys_pkcs11.go    | 54 +++++++++++++++++++++++++
 7 files changed, 200 insertions(+), 179 deletions(-)
 create mode 100644 cmd/notary/keys_nonpkcs11.go
 create mode 100644 cmd/notary/keys_pkcs11.go
 create mode 100644 signer/keys/keys_pkcs11.go

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 72d11b1a3d..6104edd987 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -7,14 +7,9 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
-	"github.com/docker/notary/cryptoservice"
-	"github.com/docker/notary/signer/api"
-	"github.com/docker/notary/trustmanager"
 
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/signed"
 	"github.com/spf13/cobra"
 )
 
@@ -98,18 +93,7 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	yubiStore, _ := api.NewYubiKeyStore(fileKeyStore, retriever)
-	var cs signed.CryptoService
-	if yubiStore == nil {
-		cs = cryptoservice.NewCryptoService("", fileKeyStore)
-	} else {
-		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
-	}
+	cs := getCryptoService(cmd, trustDir, retriever, true)
 
 	// Get a map of all the keys/roles
 	keysMap := cs.ListAllKeys()
@@ -159,19 +143,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
-	var cs signed.CryptoService
-	if err != nil {
-		cmd.Printf("No Yubikey detected, importing to local filesystem.")
-		cs = cryptoservice.NewCryptoService("", fileKeyStore)
-	} else {
-		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
-	}
+	cs := getCryptoService(cmd, trustDir, retriever, true)
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
 	if err != nil {
@@ -192,12 +164,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	cs := getCryptoService(cmd, trustDir, retriever, false)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -237,12 +204,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	cs := getCryptoService(cmd, trustDir, retriever, false)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -274,12 +236,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	cs := cryptoservice.NewCryptoService("", fileKeyStore)
+	cs := getCryptoService(cmd, trustDir, retriever, false)
 
 	zipReader, err := zip.OpenReader(importFilename)
 	if err != nil {
@@ -305,19 +262,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	yubiStore, err := api.NewYubiKeyStore(fileKeyStore, retriever)
-	var cs signed.CryptoService
-	if err != nil {
-		cmd.Printf("No Yubikey detected, importing to local filesystem.")
-		cs = cryptoservice.NewCryptoService("", fileKeyStore)
-	} else {
-		cs = cryptoservice.NewCryptoService("", yubiStore, fileKeyStore)
-	}
+	cs := getCryptoService(cmd, trustDir, retriever, true)
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
diff --git a/cmd/notary/keys_nonpkcs11.go b/cmd/notary/keys_nonpkcs11.go
new file mode 100644
index 0000000000..31179d02e6
--- /dev/null
+++ b/cmd/notary/keys_nonpkcs11.go
@@ -0,0 +1,24 @@
+// +build !pkcs11
+
+package main
+
+import (
+	"path/filepath"
+
+	"github.com/docker/notary"
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/trustmanager"
+	"github.com/spf13/cobra"
+)
+
+func getCryptoService(cmd *cobra.Command, directory string,
+	ret passphrase.Retriever, _ bool) *cryptoservice.CryptoService {
+
+	keysPath := filepath.Join(directory, notary.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
+	if err != nil {
+		fatalf("Failed to create private key store in directory: %s", keysPath)
+	}
+	return cryptoservice.NewCryptoService("", fileKeyStore)
+}
diff --git a/cmd/notary/keys_pkcs11.go b/cmd/notary/keys_pkcs11.go
new file mode 100644
index 0000000000..8a42941c6a
--- /dev/null
+++ b/cmd/notary/keys_pkcs11.go
@@ -0,0 +1,41 @@
+// +build pkcs11
+
+package main
+
+import (
+	"path/filepath"
+
+	"github.com/docker/notary"
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/trustmanager"
+	"github.com/spf13/cobra"
+)
+
+// Build a CryptoService, optionally including a hardware keystore.  Returns
+// the CryptoService and whether or not a hardware keystore was included.
+func getCryptoService(cmd *cobra.Command, directory string,
+	ret passphrase.Retriever, withHardware bool) *cryptoservice.CryptoService {
+
+	keysPath := filepath.Join(directory, notary.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
+	if err != nil {
+		fatalf("Failed to create private key store in directory: %s", keysPath)
+	}
+
+	ks := []trustmanager.KeyStore{fileKeyStore}
+
+	if withHardware {
+		yubiStore, err := api.NewYubiKeyStore(fileKeyStore, ret)
+		if err != nil {
+			cmd.Println("No YubiKey detected - using local filesystem only.")
+		} else {
+			// Note that the order is important, since we want to prioritize
+			// the yubikey store
+			ks = []trustmanager.KeyStore{yubiStore, fileKeyStore}
+		}
+	}
+
+	return cryptoservice.NewCryptoService("", ks...)
+}
diff --git a/signer/api/api_pkcs11_test.go b/signer/api/api_pkcs11_test.go
index f73091e916..ea7ccc5425 100644
--- a/signer/api/api_pkcs11_test.go
+++ b/signer/api/api_pkcs11_test.go
@@ -3,10 +3,21 @@
 package api_test
 
 import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
 	"os"
+	"strings"
 	"testing"
 
+	"github.com/docker/notary/signer"
+	"github.com/docker/notary/tuf/data"
+	"github.com/docker/notary/tuf/signed"
 	"github.com/miekg/pkcs11"
+	"github.com/stretchr/testify/assert"
+
+	pb "github.com/docker/notary/proto"
 )
 
 func SetupHSMEnv(t *testing.T) (*pkcs11.Ctx, pkcs11.SessionHandle) {
@@ -41,3 +52,66 @@ func SetupHSMEnv(t *testing.T) (*pkcs11.Ctx, pkcs11.SessionHandle) {
 
 	return p, session
 }
+
+func TestHSMCreateKeyHandler(t *testing.T) {
+	ctx, session := SetupHSMEnv(t)
+	defer ctx.Destroy()
+	defer ctx.Finalize()
+	defer ctx.CloseSession(session)
+	defer ctx.Logout(session)
+
+	cryptoService := signed.NewEd25519()
+	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
+
+	createKeyURL := fmt.Sprintf("%s/%s", createKeyBaseURL, data.RSAKey)
+
+	request, err := http.NewRequest("POST", createKeyURL, nil)
+	assert.Nil(t, err)
+
+	res, err := http.DefaultClient.Do(request)
+	assert.Nil(t, err)
+
+	jsonBlob, err := ioutil.ReadAll(res.Body)
+	assert.Nil(t, err)
+
+	var keyInfo *pb.PublicKey
+	err = json.Unmarshal(jsonBlob, &keyInfo)
+	assert.Nil(t, err)
+
+	assert.Equal(t, 200, res.StatusCode)
+}
+
+func TestHSMSignHandler(t *testing.T) {
+	ctx, session := SetupHSMEnv(t)
+	defer ctx.Destroy()
+	defer ctx.Finalize()
+	defer ctx.CloseSession(session)
+	defer ctx.Logout(session)
+
+	cryptoService := signed.NewEd25519()
+	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
+
+	tufKey, _ := cryptoService.Create("", data.RSAKey)
+
+	sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: tufKey.ID()}, Content: make([]byte, 10)}
+	requestJson, _ := json.Marshal(sigRequest)
+
+	reader = strings.NewReader(string(requestJson))
+
+	request, err := http.NewRequest("POST", signBaseURL, reader)
+
+	assert.Nil(t, err)
+
+	res, err := http.DefaultClient.Do(request)
+	assert.Nil(t, err)
+
+	jsonBlob, err := ioutil.ReadAll(res.Body)
+	assert.Nil(t, err)
+
+	var sig *pb.Signature
+	err = json.Unmarshal(jsonBlob, &sig)
+	assert.Nil(t, err)
+
+	assert.Equal(t, tufKey.ID, sig.KeyInfo.KeyID.ID)
+	assert.Equal(t, 200, res.StatusCode)
+}
diff --git a/signer/api/api_test.go b/signer/api/api_test.go
index 17c598f6a7..579f51a33c 100644
--- a/signer/api/api_test.go
+++ b/signer/api/api_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/signed"
 	"github.com/stretchr/testify/assert"
 
 	pb "github.com/docker/notary/proto"
@@ -125,34 +124,6 @@ func TestKeyInfoHandlerReturns404WithNonexistentKey(t *testing.T) {
 	assert.Equal(t, 404, res.StatusCode)
 }
 
-func TestHSMCreateKeyHandler(t *testing.T) {
-	ctx, session := SetupHSMEnv(t)
-	defer ctx.Destroy()
-	defer ctx.Finalize()
-	defer ctx.CloseSession(session)
-	defer ctx.Logout(session)
-
-	cryptoService := signed.NewEd25519()
-	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
-
-	createKeyURL := fmt.Sprintf("%s/%s", createKeyBaseURL, data.RSAKey)
-
-	request, err := http.NewRequest("POST", createKeyURL, nil)
-	assert.Nil(t, err)
-
-	res, err := http.DefaultClient.Do(request)
-	assert.Nil(t, err)
-
-	jsonBlob, err := ioutil.ReadAll(res.Body)
-	assert.Nil(t, err)
-
-	var keyInfo *pb.PublicKey
-	err = json.Unmarshal(jsonBlob, &keyInfo)
-	assert.Nil(t, err)
-
-	assert.Equal(t, 200, res.StatusCode)
-}
-
 func TestSoftwareCreateKeyHandler(t *testing.T) {
 	keyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
 	cryptoService := cryptoservice.NewCryptoService("", keyStore)
@@ -176,41 +147,6 @@ func TestSoftwareCreateKeyHandler(t *testing.T) {
 	assert.Nil(t, err)
 }
 
-func TestHSMSignHandler(t *testing.T) {
-	ctx, session := SetupHSMEnv(t)
-	defer ctx.Destroy()
-	defer ctx.Finalize()
-	defer ctx.CloseSession(session)
-	defer ctx.Logout(session)
-
-	cryptoService := signed.NewEd25519()
-	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
-
-	tufKey, _ := cryptoService.Create("", data.RSAKey)
-
-	sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: tufKey.ID()}, Content: make([]byte, 10)}
-	requestJson, _ := json.Marshal(sigRequest)
-
-	reader = strings.NewReader(string(requestJson))
-
-	request, err := http.NewRequest("POST", signBaseURL, reader)
-
-	assert.Nil(t, err)
-
-	res, err := http.DefaultClient.Do(request)
-	assert.Nil(t, err)
-
-	jsonBlob, err := ioutil.ReadAll(res.Body)
-	assert.Nil(t, err)
-
-	var sig *pb.Signature
-	err = json.Unmarshal(jsonBlob, &sig)
-	assert.Nil(t, err)
-
-	assert.Equal(t, tufKey.ID, sig.KeyInfo.KeyID.ID)
-	assert.Equal(t, 200, res.StatusCode)
-}
-
 func TestSoftwareSignHandler(t *testing.T) {
 	keyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
 	cryptoService := cryptoservice.NewCryptoService("", keyStore)
diff --git a/signer/keys/keys.go b/signer/keys/keys.go
index 6403c217e2..da80d6d65c 100644
--- a/signer/keys/keys.go
+++ b/signer/keys/keys.go
@@ -1,13 +1,6 @@
-// +build pkcs11
-
 package keys
 
-import (
-	"errors"
-
-	"github.com/docker/notary/tuf/data"
-	"github.com/miekg/pkcs11"
-)
+import "errors"
 
 var (
 	// ErrExists happens when a Key already exists in a database
@@ -17,49 +10,3 @@ var (
 	// ErrFailedKeyGeneration happens when there is a failure in generating a key
 	ErrFailedKeyGeneration = errors.New("notary-signer: failed to generate new key")
 )
-
-// HSMRSAKey represents the information for an HSMRSAKey with ObjectHandle for private portion
-type HSMRSAKey struct {
-	id      string
-	public  []byte
-	private pkcs11.ObjectHandle
-}
-
-// NewHSMRSAKey returns a HSMRSAKey
-func NewHSMRSAKey(public []byte, private pkcs11.ObjectHandle) *HSMRSAKey {
-	return &HSMRSAKey{
-		public:  public,
-		private: private,
-	}
-}
-
-// Algorithm implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Algorithm() string {
-	return data.RSAKey
-}
-
-// ID implements a method of the data.Key interface
-func (rsa *HSMRSAKey) ID() string {
-	if rsa.id == "" {
-		pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
-		rsa.id = pubK.ID()
-	}
-	return rsa.id
-}
-
-// Public implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Public() []byte {
-	return rsa.public
-}
-
-// Private implements a method of the data.PrivateKey interface
-func (rsa *HSMRSAKey) Private() []byte {
-	// Not possible to return private key bytes from a hardware device
-	return nil
-}
-
-// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMRSAKey
-// structure
-func (rsa *HSMRSAKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
-	return rsa.private
-}
diff --git a/signer/keys/keys_pkcs11.go b/signer/keys/keys_pkcs11.go
new file mode 100644
index 0000000000..680d2880e9
--- /dev/null
+++ b/signer/keys/keys_pkcs11.go
@@ -0,0 +1,54 @@
+// +build pkcs11
+
+package keys
+
+import (
+	"github.com/docker/notary/tuf/data"
+	"github.com/miekg/pkcs11"
+)
+
+// HSMRSAKey represents the information for an HSMRSAKey with ObjectHandle for private portion
+type HSMRSAKey struct {
+	id      string
+	public  []byte
+	private pkcs11.ObjectHandle
+}
+
+// NewHSMRSAKey returns a HSMRSAKey
+func NewHSMRSAKey(public []byte, private pkcs11.ObjectHandle) *HSMRSAKey {
+	return &HSMRSAKey{
+		public:  public,
+		private: private,
+	}
+}
+
+// Algorithm implements a method of the data.Key interface
+func (rsa *HSMRSAKey) Algorithm() string {
+	return data.RSAKey
+}
+
+// ID implements a method of the data.Key interface
+func (rsa *HSMRSAKey) ID() string {
+	if rsa.id == "" {
+		pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
+		rsa.id = pubK.ID()
+	}
+	return rsa.id
+}
+
+// Public implements a method of the data.Key interface
+func (rsa *HSMRSAKey) Public() []byte {
+	return rsa.public
+}
+
+// Private implements a method of the data.PrivateKey interface
+func (rsa *HSMRSAKey) Private() []byte {
+	// Not possible to return private key bytes from a hardware device
+	return nil
+}
+
+// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMRSAKey
+// structure
+func (rsa *HSMRSAKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
+	return rsa.private
+}

From d9d7b2639ebf10d5e8f926cc3e18eec2e7c997c4 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Sun, 8 Nov 2015 11:19:35 -0800
Subject: [PATCH 43/85] Removing integration script

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 integration/test.sh | 36 ------------------------------------
 1 file changed, 36 deletions(-)
 delete mode 100755 integration/test.sh

diff --git a/integration/test.sh b/integration/test.sh
deleted file mode 100755
index f69c109ef4..0000000000
--- a/integration/test.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/sh
-
-set -x
-set -e
-
-export NOTARY_ROOT_PASSPHRASE="ponies"
-export NOTARY_SNAPSHOT_PASSPHRASE="ponies"
-export NOTARY_TARGET_PASSPHRASE="ponies"
-
-tmpdir=`mktemp -d -t notary-integration-XXXXXXXXXXXXXXX`
-new_repo=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
-new_tag=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 10 | head -n 1)
-
-make binaries
-# Test init, add, publish and list
-./bin/notary -d $tmpdir init -s $1 $new_repo || echo "FAILED"
-./bin/notary -d $tmpdir add $new_repo $new_tag README.md || echo "FAILED"
-./bin/notary -d $tmpdir publish -s $1 $new_repo || echo "FAILED"
-./bin/notary -d $tmpdir list -s $1 $new_repo | grep $new_tag || echo "FAILED"
-
-# Test remove, publish and list
-./bin/notary -d $tmpdir remove $new_repo $new_tag || echo "FAILED"
-./bin/notary -d $tmpdir publish -s $1 $new_repo || echo "FAILED"
-./bin/notary -d $tmpdir list -s $1 $new_repo | grep $new_tag && echo "FAILED"
-
-# Test key existence/key removal
-./bin/notary -d $tmpdir key list | grep -v '^$'| grep $new_repo | wc -l | grep 2 || echo "FAILED"
-rootID=`./bin/notary -d $tmpdir key list | grep -v '^$' | grep -v $new_repo | grep -v "#" | awk '{print $0}'`
-./bin/notary -d $tmpdir key remove -y -r $rootID || echo "FAILED"
-./bin/notary -d $tmpdir key list | grep -v '^$'| grep -v $new_repo | grep -v "#" | wc -l | grep 0 || echo "FAILED"
-
-# Test cert existence/cert removal
-./bin/notary -d $tmpdir cert list | grep -v '^$'| grep $new_repo | wc -l | grep 1 || echo "FAILED"
-certID=`./bin/notary -d $tmpdir cert list | grep $new_repo | awk '{print $2}'`
-./bin/notary -d $tmpdir cert remove -y $certID || echo "FAILED"
-./bin/notary -d $tmpdir cert list | grep -v '^$' | grep $new_repo && echo "FAILED"

From 30224f27ae1923be725c3c1366137ce989e91df1 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sat, 7 Nov 2015 23:17:07 -0800
Subject: [PATCH 44/85] Search a list of possible paths for the Yubico pkcs11
 library.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 signer/api/ecdsa_hardware_crypto_service.go | 23 +++++++++++++++++++--
 signer/api/pkcs11_darwin.go                 | 10 +++------
 signer/api/pkcs11_linux.go                  | 11 ++++------
 3 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/signer/api/ecdsa_hardware_crypto_service.go
index 95d13c0de2..2b33e839c4 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/signer/api/ecdsa_hardware_crypto_service.go
@@ -13,6 +13,7 @@ import (
 	"fmt"
 	"io"
 	"math/big"
+	"os"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/passphrase"
@@ -48,8 +49,20 @@ func SetYubikeyKeyMode(keyMode int) error {
 	return nil
 }
 
-// Hardcoded yubikey PKCS11 ID
-var YUBIKEY_ROOT_KEY_ID = []byte{2}
+var pkcs11Lib string
+
+func init() {
+	for _, loc := range possiblePkcs11Libs {
+		_, err := os.Stat(loc)
+		if err == nil {
+			p := pkcs11.New(loc)
+			if p != nil {
+				pkcs11Lib = loc
+				return
+			}
+		}
+	}
+}
 
 type ErrBackupFailed struct {
 	err string
@@ -630,6 +643,9 @@ func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
 
 // SetupHSMEnv is a method that depends on the existences
 func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error) {
+	if libraryPath == "" {
+		return nil, 0, errors.New("No library found.")
+	}
 	p := pkcs11.New(libraryPath)
 
 	if p == nil {
@@ -661,6 +677,9 @@ func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error)
 
 // YubikeyEnabled returns true if a Yubikey can be accessed
 func YubikeyAccessible() bool {
+	if pkcs11Lib == "" {
+		return false
+	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
 		return false
diff --git a/signer/api/pkcs11_darwin.go b/signer/api/pkcs11_darwin.go
index eba8a4ee2c..0fe1f437a6 100644
--- a/signer/api/pkcs11_darwin.go
+++ b/signer/api/pkcs11_darwin.go
@@ -2,11 +2,7 @@
 
 package api
 
-var (
-	pkcs11Lib = "/usr/local/lib/libykcs11.dylib"
-)
-
-func init() {
-	// TODO(diogomonica): all the crap for darwin to configure
-	// the variable pkcs11 to find the right one in the right dir
+var possiblePkcs11Libs = []string{
+	"/usr/local/lib/libykcs11.dylib",
+	"/usr/local/docker/lib/libykcs11.dylib",
 }
diff --git a/signer/api/pkcs11_linux.go b/signer/api/pkcs11_linux.go
index acade89b11..9af1874196 100644
--- a/signer/api/pkcs11_linux.go
+++ b/signer/api/pkcs11_linux.go
@@ -2,11 +2,8 @@
 
 package api
 
-var (
-	pkcs11Lib = "/usr/local/lib/libykcs11.so"
-)
-
-func init() {
-	// TODO(diogomonica): all the crap for linux to configure
-	// the variable pkcs11 to find the right one in the right dir
+var possiblePkcs11Libs = []string{
+	"/usr/lib/libykcs11.so",
+	"/usr/lib/x86_64-linux-gnu/libykcs11.so",
+	"/usr/local/lib/libykcs11.so",
 }

From c82802b800c5cf4d31073a5fc5b442e3cbc62732 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 12:29:16 -0800
Subject: [PATCH 45/85] Move ecdsa_hardware_crypto_service to
 trustmanager/yubikeystore

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 client/repo_pkcs11.go                         |  3 +-
 cmd/notary/integration_pkcs11_test.go         | 14 +++----
 cmd/notary/keys_pkcs11.go                     |  3 +-
 {signer/api => trustmanager}/pkcs11_darwin.go |  2 +-
 {signer/api => trustmanager}/pkcs11_linux.go  |  2 +-
 .../yubikeystore.go                           | 37 ++++++++++++-------
 6 files changed, 34 insertions(+), 27 deletions(-)
 rename {signer/api => trustmanager}/pkcs11_darwin.go (86%)
 rename {signer/api => trustmanager}/pkcs11_linux.go (88%)
 rename signer/api/ecdsa_hardware_crypto_service.go => trustmanager/yubikeystore.go (93%)

diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index 260aaca742..ed82bd555b 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -11,7 +11,6 @@ import (
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
-	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/signed"
 	"github.com/docker/notary/tuf/store"
@@ -30,7 +29,7 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
-	yubiKeyStore, _ := api.NewYubiKeyStore(fileKeyStore, retriever)
+	yubiKeyStore, _ := trustmanager.NewYubiKeyStore(fileKeyStore, retriever)
 	var cryptoService signed.CryptoService
 	if yubiKeyStore == nil {
 		cryptoService = cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
diff --git a/cmd/notary/integration_pkcs11_test.go b/cmd/notary/integration_pkcs11_test.go
index 436bbee373..6f29ad0c08 100644
--- a/cmd/notary/integration_pkcs11_test.go
+++ b/cmd/notary/integration_pkcs11_test.go
@@ -6,12 +6,12 @@ import (
 	"testing"
 
 	"github.com/docker/notary/passphrase"
-	"github.com/docker/notary/signer/api"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/assert"
 )
 
-var rootOnHardware = api.YubikeyAccessible
+var rootOnHardware = trustmanager.YubikeyAccessible
 
 // Per-test set up that returns a cleanup function.  This set up:
 // - changes the passphrase retriever to always produce a constant passphrase
@@ -29,10 +29,10 @@ func setUp(t *testing.T) func() {
 
 	retriever = fake
 	getRetriever = func() passphrase.Retriever { return fake }
-	api.SetYubikeyKeyMode(api.KeymodeNone)
+	trustmanager.SetYubikeyKeyMode(trustmanager.KeymodeNone)
 
 	// //we're just removing keys here, so nil is fine
-	s, err := api.NewYubiKeyStore(nil, retriever)
+	s, err := trustmanager.NewYubiKeyStore(nil, retriever)
 	assert.NoError(t, err)
 	for k := range s.ListKeys() {
 		err := s.RemoveKey(k)
@@ -42,7 +42,7 @@ func setUp(t *testing.T) func() {
 	return func() {
 		retriever = oldRetriever
 		getRetriever = getPassphraseRetriever
-		api.SetYubikeyKeyMode(api.KeymodeTouch | api.KeymodePinOnce)
+		trustmanager.SetYubikeyKeyMode(trustmanager.KeymodeTouch | trustmanager.KeymodePinOnce)
 	}
 }
 
@@ -51,9 +51,9 @@ func setUp(t *testing.T) func() {
 // on disk
 func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) {
 	// do not bother verifying if there is no yubikey available
-	if api.YubikeyAccessible() {
+	if trustmanager.YubikeyAccessible() {
 		// //we're just getting keys here, so nil is fine
-		s, err := api.NewYubiKeyStore(nil, retriever)
+		s, err := trustmanager.NewYubiKeyStore(nil, retriever)
 		assert.NoError(t, err)
 		privKey, role, err := s.GetKey(rootKeyID)
 		assert.NoError(t, err)
diff --git a/cmd/notary/keys_pkcs11.go b/cmd/notary/keys_pkcs11.go
index 8a42941c6a..e1df821d12 100644
--- a/cmd/notary/keys_pkcs11.go
+++ b/cmd/notary/keys_pkcs11.go
@@ -8,7 +8,6 @@ import (
 	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/passphrase"
-	"github.com/docker/notary/signer/api"
 	"github.com/docker/notary/trustmanager"
 	"github.com/spf13/cobra"
 )
@@ -27,7 +26,7 @@ func getCryptoService(cmd *cobra.Command, directory string,
 	ks := []trustmanager.KeyStore{fileKeyStore}
 
 	if withHardware {
-		yubiStore, err := api.NewYubiKeyStore(fileKeyStore, ret)
+		yubiStore, err := trustmanager.NewYubiKeyStore(fileKeyStore, ret)
 		if err != nil {
 			cmd.Println("No YubiKey detected - using local filesystem only.")
 		} else {
diff --git a/signer/api/pkcs11_darwin.go b/trustmanager/pkcs11_darwin.go
similarity index 86%
rename from signer/api/pkcs11_darwin.go
rename to trustmanager/pkcs11_darwin.go
index 0fe1f437a6..63f1888b38 100644
--- a/signer/api/pkcs11_darwin.go
+++ b/trustmanager/pkcs11_darwin.go
@@ -1,6 +1,6 @@
 // +build pkcs11,darwin
 
-package api
+package trustmanager
 
 var possiblePkcs11Libs = []string{
 	"/usr/local/lib/libykcs11.dylib",
diff --git a/signer/api/pkcs11_linux.go b/trustmanager/pkcs11_linux.go
similarity index 88%
rename from signer/api/pkcs11_linux.go
rename to trustmanager/pkcs11_linux.go
index 9af1874196..9765299914 100644
--- a/signer/api/pkcs11_linux.go
+++ b/trustmanager/pkcs11_linux.go
@@ -1,6 +1,6 @@
 // +build pkcs11,linux
 
-package api
+package trustmanager
 
 var possiblePkcs11Libs = []string{
 	"/usr/lib/libykcs11.so",
diff --git a/signer/api/ecdsa_hardware_crypto_service.go b/trustmanager/yubikeystore.go
similarity index 93%
rename from signer/api/ecdsa_hardware_crypto_service.go
rename to trustmanager/yubikeystore.go
index 2b33e839c4..ee8ca17ade 100644
--- a/signer/api/ecdsa_hardware_crypto_service.go
+++ b/trustmanager/yubikeystore.go
@@ -1,6 +1,6 @@
 // +build pkcs11
 
-package api
+package trustmanager
 
 import (
 	"crypto"
@@ -17,7 +17,6 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/passphrase"
-	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/miekg/pkcs11"
 )
@@ -145,7 +144,7 @@ func addECDSAKey(
 	pkcs11KeyID []byte,
 	passRetriever passphrase.Retriever,
 	role string,
-	backupStore trustmanager.KeyStore,
+	backupStore KeyStore,
 ) error {
 	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
 
@@ -165,7 +164,7 @@ func addECDSAKey(
 	ecdsaPrivKeyD := ecdsaPrivKey.D.Bytes()
 	logrus.Debugf("Getting D bytes: %v\n", ecdsaPrivKeyD)
 
-	template, err := trustmanager.NewCertificate(role)
+	template, err := NewCertificate(role)
 	if err != nil {
 		return fmt.Errorf("failed to create the certificate template: %v", err)
 	}
@@ -316,7 +315,7 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	return sig[:], nil
 }
 
-func removeKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
+func yubiRemoveKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
 	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN)
 	if err != nil {
 		return err
@@ -357,7 +356,7 @@ func removeKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte
 	return nil
 }
 
-func listKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[string]yubiSlot, err error) {
+func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[string]yubiSlot, err error) {
 	keys = make(map[string]yubiSlot)
 	findTemplate := []*pkcs11.Attribute{
 		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
@@ -512,13 +511,18 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 	return nil, errors.New("Yubikey has no available slots.")
 }
 
+// YubiKeyStore is a KeyStore for private keys inside a Yubikey
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
-	backupStore   trustmanager.KeyStore
+	backupStore   KeyStore
 }
 
-func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) (*YubiKeyStore, error) {
+// NewYubiKeyStore returns a YubiKeyStore, given a backup key store to write any
+// generated keys to (usually a KeyFileStore)
+func NewYubiKeyStore(backupStore KeyStore, passphraseRetriever passphrase.Retriever) (
+	*YubiKeyStore, error) {
+
 	s := &YubiKeyStore{
 		passRetriever: passphraseRetriever,
 		keys:          make(map[string]yubiSlot),
@@ -537,7 +541,7 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 		return nil
 	}
 	defer cleanup(ctx, session)
-	keys, err := listKeys(ctx, session)
+	keys, err := yubiListKeys(ctx, session)
 	if err != nil {
 		return nil
 	}
@@ -545,6 +549,7 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 	return buildKeyMap(keys)
 }
 
+// AddKey puts a key inside the Yubikey, as well as writing it to the backup store
 func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error {
 	// We only allow adding root keys for now
 	if role != data.CanonicalRootRole {
@@ -580,6 +585,8 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 	return err
 }
 
+// GetKey retrieves a key from the Yubikey only (it does not look inside the
+// backup store)
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
@@ -608,6 +615,8 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	return privKey, alias, err
 }
 
+// RemoveKey deletes a key from the Yubikey only (it does not remove it from the
+// backup store)
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
@@ -618,7 +627,7 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	if !ok {
 		return errors.New("Key not present in yubikey")
 	}
-	return removeKey(ctx, session, key.slotID, s.passRetriever, keyID)
+	return yubiRemoveKey(ctx, session, key.slotID, s.passRetriever, keyID)
 }
 
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
@@ -628,7 +637,7 @@ func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
 
 func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
 	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyID)
-	privKey, _, err := trustmanager.GetPasswdDecryptBytes(s.passRetriever, pemBytes, "imported", "root")
+	privKey, _, err := GetPasswdDecryptBytes(s.passRetriever, pemBytes, "imported", "root")
 	if err != nil {
 		return err
 	}
@@ -675,7 +684,7 @@ func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error)
 	return p, session, nil
 }
 
-// YubikeyEnabled returns true if a Yubikey can be accessed
+// YubikeyAccessible returns true if a Yubikey can be accessed
 func YubikeyAccessible() bool {
 	if pkcs11Lib == "" {
 		return false
@@ -710,10 +719,10 @@ func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphra
 		passwd, giveup, err := passRetriever(user, "yubikey", false, attempts)
 		// Check if the passphrase retriever got an error or if it is telling us to give up
 		if giveup || err != nil {
-			return trustmanager.ErrPasswordInvalid{}
+			return ErrPasswordInvalid{}
 		}
 		if attempts > 2 {
-			return trustmanager.ErrAttemptsExceeded{}
+			return ErrAttemptsExceeded{}
 		}
 
 		// Try to convert PEM encoded bytes back to a PrivateKey using the passphrase

From 5fe09ad8e12273ff0fbe107dc50200e30b10b2b1 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 14:31:27 -0800
Subject: [PATCH 46/85] Remove softhsm keys and tests.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 signer/api/api_pkcs11_test.go | 117 ----------------------------------
 signer/keys/keys_pkcs11.go    |  54 ----------------
 signer/softhsm2.conf          |   5 --
 3 files changed, 176 deletions(-)
 delete mode 100644 signer/api/api_pkcs11_test.go
 delete mode 100644 signer/keys/keys_pkcs11.go
 delete mode 100644 signer/softhsm2.conf

diff --git a/signer/api/api_pkcs11_test.go b/signer/api/api_pkcs11_test.go
deleted file mode 100644
index ea7ccc5425..0000000000
--- a/signer/api/api_pkcs11_test.go
+++ /dev/null
@@ -1,117 +0,0 @@
-// +build pkcs11
-
-package api_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/docker/notary/signer"
-	"github.com/docker/notary/tuf/data"
-	"github.com/docker/notary/tuf/signed"
-	"github.com/miekg/pkcs11"
-	"github.com/stretchr/testify/assert"
-
-	pb "github.com/docker/notary/proto"
-)
-
-func SetupHSMEnv(t *testing.T) (*pkcs11.Ctx, pkcs11.SessionHandle) {
-	var libPath = "/usr/local/lib/softhsm/libsofthsm2.so"
-	if _, err := os.Stat(libPath); err != nil {
-		t.Skipf("Skipping test. Library path: %s does not exist", libPath)
-	}
-
-	p := pkcs11.New(libPath)
-
-	if p == nil {
-		t.Fatalf("Failed to init library")
-	}
-
-	if err := p.Initialize(); err != nil {
-		t.Fatalf("Initialize error %s\n", err.Error())
-	}
-
-	slots, err := p.GetSlotList(true)
-	if err != nil {
-		t.Fatalf("Failed to list HSM slots %s", err)
-	}
-
-	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-	if err != nil {
-		t.Fatalf("Failed to Start Session with HSM %s", err)
-	}
-
-	if err = p.Login(session, pkcs11.CKU_USER, "1234"); err != nil {
-		t.Fatalf("User PIN %s\n", err.Error())
-	}
-
-	return p, session
-}
-
-func TestHSMCreateKeyHandler(t *testing.T) {
-	ctx, session := SetupHSMEnv(t)
-	defer ctx.Destroy()
-	defer ctx.Finalize()
-	defer ctx.CloseSession(session)
-	defer ctx.Logout(session)
-
-	cryptoService := signed.NewEd25519()
-	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
-
-	createKeyURL := fmt.Sprintf("%s/%s", createKeyBaseURL, data.RSAKey)
-
-	request, err := http.NewRequest("POST", createKeyURL, nil)
-	assert.Nil(t, err)
-
-	res, err := http.DefaultClient.Do(request)
-	assert.Nil(t, err)
-
-	jsonBlob, err := ioutil.ReadAll(res.Body)
-	assert.Nil(t, err)
-
-	var keyInfo *pb.PublicKey
-	err = json.Unmarshal(jsonBlob, &keyInfo)
-	assert.Nil(t, err)
-
-	assert.Equal(t, 200, res.StatusCode)
-}
-
-func TestHSMSignHandler(t *testing.T) {
-	ctx, session := SetupHSMEnv(t)
-	defer ctx.Destroy()
-	defer ctx.Finalize()
-	defer ctx.CloseSession(session)
-	defer ctx.Logout(session)
-
-	cryptoService := signed.NewEd25519()
-	setup(signer.CryptoServiceIndex{data.RSAKey: cryptoService})
-
-	tufKey, _ := cryptoService.Create("", data.RSAKey)
-
-	sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: tufKey.ID()}, Content: make([]byte, 10)}
-	requestJson, _ := json.Marshal(sigRequest)
-
-	reader = strings.NewReader(string(requestJson))
-
-	request, err := http.NewRequest("POST", signBaseURL, reader)
-
-	assert.Nil(t, err)
-
-	res, err := http.DefaultClient.Do(request)
-	assert.Nil(t, err)
-
-	jsonBlob, err := ioutil.ReadAll(res.Body)
-	assert.Nil(t, err)
-
-	var sig *pb.Signature
-	err = json.Unmarshal(jsonBlob, &sig)
-	assert.Nil(t, err)
-
-	assert.Equal(t, tufKey.ID, sig.KeyInfo.KeyID.ID)
-	assert.Equal(t, 200, res.StatusCode)
-}
diff --git a/signer/keys/keys_pkcs11.go b/signer/keys/keys_pkcs11.go
deleted file mode 100644
index 680d2880e9..0000000000
--- a/signer/keys/keys_pkcs11.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// +build pkcs11
-
-package keys
-
-import (
-	"github.com/docker/notary/tuf/data"
-	"github.com/miekg/pkcs11"
-)
-
-// HSMRSAKey represents the information for an HSMRSAKey with ObjectHandle for private portion
-type HSMRSAKey struct {
-	id      string
-	public  []byte
-	private pkcs11.ObjectHandle
-}
-
-// NewHSMRSAKey returns a HSMRSAKey
-func NewHSMRSAKey(public []byte, private pkcs11.ObjectHandle) *HSMRSAKey {
-	return &HSMRSAKey{
-		public:  public,
-		private: private,
-	}
-}
-
-// Algorithm implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Algorithm() string {
-	return data.RSAKey
-}
-
-// ID implements a method of the data.Key interface
-func (rsa *HSMRSAKey) ID() string {
-	if rsa.id == "" {
-		pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
-		rsa.id = pubK.ID()
-	}
-	return rsa.id
-}
-
-// Public implements a method of the data.Key interface
-func (rsa *HSMRSAKey) Public() []byte {
-	return rsa.public
-}
-
-// Private implements a method of the data.PrivateKey interface
-func (rsa *HSMRSAKey) Private() []byte {
-	// Not possible to return private key bytes from a hardware device
-	return nil
-}
-
-// PKCS11ObjectHandle returns the PKCS11 object handle stored in the HSMRSAKey
-// structure
-func (rsa *HSMRSAKey) PKCS11ObjectHandle() pkcs11.ObjectHandle {
-	return rsa.private
-}
diff --git a/signer/softhsm2.conf b/signer/softhsm2.conf
deleted file mode 100644
index 775101f967..0000000000
--- a/signer/softhsm2.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-# SoftHSM v2 configuration file
-
-directories.tokendir = /softhsm2/tokens
-objectstore.backend = db
-log.level = INFO

From ef1d5caa1ae2bf49c787c13ce3e8e5e7a04ad0f0 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 16:09:52 -0800
Subject: [PATCH 47/85] Fix an error message when there are insufficient
 signatures.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 tuf/signed/errors.go | 3 +--
 tuf/signed/sign.go   | 5 +++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tuf/signed/errors.go b/tuf/signed/errors.go
index c042e60685..6cddcf2ba4 100644
--- a/tuf/signed/errors.go
+++ b/tuf/signed/errors.go
@@ -8,11 +8,10 @@ import (
 // metadata
 type ErrInsufficientSignatures struct {
 	Name string
-	Err  error
 }
 
 func (e ErrInsufficientSignatures) Error() string {
-	return fmt.Sprintf("tuf: insufficient signatures for %s: %s", e.Name, e.Err)
+	return fmt.Sprintf("tuf: insufficient signatures: %s", e.Name)
 }
 
 // ErrExpired indicates a piece of metadata has expired
diff --git a/tuf/signed/sign.go b/tuf/signed/sign.go
index 99987a2fb5..48a6efd7f0 100644
--- a/tuf/signed/sign.go
+++ b/tuf/signed/sign.go
@@ -68,8 +68,9 @@ func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
 	}
 	if len(signatures) < 1 {
 		return ErrInsufficientSignatures{
-			Name: fmt.Sprintf("Cryptoservice failed to produce any signatures for keys with IDs: %v", keyIDs),
-			Err:  nil,
+			Name: fmt.Sprintf(
+				"Cryptoservice failed to produce any signatures for keys with IDs: %v",
+				keyIDs),
 		}
 	}
 	for _, sig := range s.Signatures {

From 9a01cf091d8fde7519ac202bd55d9f1a8d21a2b8 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 16:12:59 -0800
Subject: [PATCH 48/85] Add "notary lookup" to the integration tests.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/integration_test.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
index dd6dec2d41..328ce08e1b 100644
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -118,6 +118,11 @@ func TestClientTufInteraction(t *testing.T) {
 	assert.NoError(t, err)
 	assert.True(t, strings.Contains(string(output), target))
 
+	// lookup target and repo - see target
+	output, err = runCommand(t, tempDir, "-s", server.URL, "lookup", "gun", target)
+	assert.NoError(t, err)
+	assert.True(t, strings.Contains(string(output), target))
+
 	// verify repo - empty file
 	output, err = runCommand(t, tempDir, "verify", "gun", target)
 	assert.NoError(t, err)

From 53114aabdcac2adba3d1cafcd204e07df8551e05 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 16:36:35 -0800
Subject: [PATCH 49/85] Add a test to test adding multiple keys to a yubikey.

If there are existing keys on the Yubikey, the YubiKeyStore should add
a key to the next available slot.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 passphrase/passphrase.go          |  8 ++++
 trustmanager/yubikeystore.go      |  6 ++-
 trustmanager/yubikeystore_test.go | 65 +++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 trustmanager/yubikeystore_test.go

diff --git a/passphrase/passphrase.go b/passphrase/passphrase.go
index 777de63721..3933ff1f71 100644
--- a/passphrase/passphrase.go
+++ b/passphrase/passphrase.go
@@ -182,3 +182,11 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 		return retPass, false, nil
 	}
 }
+
+// ConstantRetriever returns a new Retriever which will return a constant string
+// as a passphrase.
+func ConstantRetriever(constantPassphrase string) Retriever {
+	return func(k, a string, c bool, n int) (string, bool, error) {
+		return constantPassphrase, false, nil
+	}
+}
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index ee8ca17ade..1544556708 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -627,7 +627,11 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	if !ok {
 		return errors.New("Key not present in yubikey")
 	}
-	return yubiRemoveKey(ctx, session, key.slotID, s.passRetriever, keyID)
+	err = yubiRemoveKey(ctx, session, key.slotID, s.passRetriever, keyID)
+	if err == nil {
+		delete(s.keys, keyID)
+	}
+	return err
 }
 
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikeystore_test.go
new file mode 100644
index 0000000000..6c1afe7e93
--- /dev/null
+++ b/trustmanager/yubikeystore_test.go
@@ -0,0 +1,65 @@
+// +build pkcs11
+
+package trustmanager
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/tuf/data"
+	"github.com/stretchr/testify/assert"
+)
+
+func clearAllKeys(t *testing.T) {
+	// TODO(cyli): this is creating a new yubikey store because for some reason,
+	// removing and then adding with the same YubiKeyStore causes
+	// non-deterministic failures at least on Mac OS
+	ret := passphrase.ConstantRetriever("passphrase")
+	store, err := NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	for k := range store.ListKeys() {
+		err := store.RemoveKey(k)
+		assert.NoError(t, err)
+	}
+}
+
+func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	ret := passphrase.ConstantRetriever("passphrase")
+	store, err := NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	keys := make([]string, 0, numSlots)
+
+	// create the maximum number of keys
+	for i := 0; i < numSlots; i++ {
+		privKey, err := GenerateECDSAKey(rand.Reader)
+		assert.NoError(t, err)
+
+		err = store.AddKey(privKey.ID(), data.CanonicalRootRole, privKey)
+		assert.NoError(t, err)
+
+		keys = append(keys, privKey.ID())
+	}
+
+	listedKeys := store.ListKeys()
+	assert.Len(t, listedKeys, numSlots)
+	for _, k := range keys {
+		r, ok := listedKeys[k]
+		assert.True(t, ok)
+		assert.Equal(t, data.CanonicalRootRole, r)
+	}
+
+	// numSlots is not actually the max - some keys might have more, so do not
+	// test that adding more keys will fail.
+}

From baa92cefa3a90f7fbc33b7b920b758658f0067a3 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Sun, 8 Nov 2015 17:20:11 -0800
Subject: [PATCH 50/85] Fixed panic on listKeys with invalid keys, added tests

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 trustmanager/keyfilestore.go      | 18 ++++++++--
 trustmanager/keyfilestore_test.go | 55 +++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index ed8339cfe1..977e3e6983 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -212,14 +212,28 @@ func listKeys(s LimitedFileStore) map[string]string {
 	keyIDMap := make(map[string]string)
 
 	for _, f := range s.ListFiles() {
+		// Remove the prefix of the directory from the filename
 		if f[:len(rootKeysSubdir)] == rootKeysSubdir {
 			f = strings.TrimPrefix(f, rootKeysSubdir+"/")
 		} else {
 			f = strings.TrimPrefix(f, nonRootKeysSubdir+"/")
 		}
+
+		// Remove the extension from the full filename
+		// abcde_root.key becomes abcde_root
 		keyIDFull := strings.TrimSpace(strings.TrimSuffix(f, filepath.Ext(f)))
-		keyID := keyIDFull[:strings.LastIndex(keyIDFull, "_")]
-		keyAlias := keyIDFull[strings.LastIndex(keyIDFull, "_")+1:]
+
+		// If the key does not have a _, it is malformed
+		underscoreIndex := strings.LastIndex(keyIDFull, "_")
+		if underscoreIndex == -1 {
+			continue
+		}
+
+		// The keyID is the first part of the keyname
+		// The KeyAlias is the second part of the keyname
+		// in a key named abcde_root, abcde is the keyID and root is the KeyAlias
+		keyID := keyIDFull[:underscoreIndex]
+		keyAlias := keyIDFull[underscoreIndex+1:]
 		keyIDMap[keyID] = keyAlias
 	}
 	return keyIDMap
diff --git a/trustmanager/keyfilestore_test.go b/trustmanager/keyfilestore_test.go
index fa418bf5a6..16e39f31f5 100644
--- a/trustmanager/keyfilestore_test.go
+++ b/trustmanager/keyfilestore_test.go
@@ -114,6 +114,60 @@ EMl3eFOJXjIch/wIesRSN+2dGOsl7neercjMh1i9RvpCwHDx/E0=
 	assert.Equal(t, testData, pemPrivKey)
 }
 
+func TestListKeys(t *testing.T) {
+	testName := "docker.com/notary/root"
+	perms := os.FileMode(0755)
+
+	// Temporary directory where test files will be created
+	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
+	assert.NoError(t, err, "failed to create a temporary directory")
+	defer os.RemoveAll(tempBaseDir)
+
+	// Create our store
+	store, err := NewKeyFileStore(tempBaseDir, passphraseRetriever)
+	assert.NoError(t, err, "failed to create new key filestore")
+
+	privKey, err := GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err, "could not generate private key")
+
+	// Call the AddKey function
+	err = store.AddKey(testName, "root", privKey)
+	assert.NoError(t, err, "failed to add key to store")
+
+	// Check to see if the keystore lists this key
+	keyMap := store.ListKeys()
+
+	// Expect to see exactly one key in the map
+	assert.Len(t, keyMap, 1)
+	// Expect to see privKeyID inside of the map
+	role, ok := keyMap[testName]
+	assert.True(t, ok)
+	assert.Equal(t, role, "root")
+
+	// Call the AddKey function for the second key
+	err = store.AddKey(testName+"2", "targets", privKey)
+	assert.NoError(t, err, "failed to add key to store")
+
+	// Check to see if the keystore lists this key
+	keyMap = store.ListKeys()
+
+	// Expect to see exactly two keys in the map
+	assert.Len(t, keyMap, 2)
+	// Expect to see privKeyID2 inside of the map
+	role, ok = keyMap[testName+"2"]
+	assert.True(t, ok)
+	assert.Equal(t, role, "targets")
+
+	// Write an invalid filename to the directory
+	filePath := filepath.Join(tempBaseDir, rootKeysSubdir, "fakekeyname.key")
+	err = ioutil.WriteFile(filePath, []byte("data"), perms)
+	assert.NoError(t, err, "failed to write test file")
+
+	// Check to see if the keystore still lists two keys
+	keyMap = store.ListKeys()
+	assert.Len(t, keyMap, 2)
+}
+
 func TestAddGetKeyMemStore(t *testing.T) {
 	testName := "docker.com/notary/root"
 	testAlias := "root"
@@ -136,6 +190,7 @@ func TestAddGetKeyMemStore(t *testing.T) {
 	assert.Equal(t, retrievedKey.Public(), privKey.Public())
 	assert.Equal(t, retrievedKey.Private(), privKey.Private())
 }
+
 func TestGetDecryptedWithTamperedCipherText(t *testing.T) {
 	testExt := "key"
 	testAlias := "root"

From 9ae2c80309d8a143c9721ef08cab8e4d6e0bdd46 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 23:01:16 -0800
Subject: [PATCH 51/85] Fix bug with finding new slots to put keys. Previously
 it was just overwritting one slot over and over.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikeystore.go      |  4 +++-
 trustmanager/yubikeystore_test.go | 29 ++++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index 1544556708..055b429a2c 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -462,6 +462,8 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 		return nil, err
 	}
 	objs, b, err := ctx.FindObjects(session, numSlots)
+	// if there are more objects than `numSlots`, get all of them until
+	// there are no more to get
 	for err == nil {
 		var o []pkcs11.ObjectHandle
 		o, b, err = ctx.FindObjects(session, numSlots)
@@ -495,7 +497,7 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 				// a byte will always be capable of representing all slot IDs
 				// for the Yubikeys
 				slotNum := int(a.Value[0])
-				if slotNum >= len(taken) {
+				if slotNum >= numSlots {
 					// defensive
 					continue
 				}
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikeystore_test.go
index 6c1afe7e93..d0f63e9c4e 100644
--- a/trustmanager/yubikeystore_test.go
+++ b/trustmanager/yubikeystore_test.go
@@ -25,6 +25,14 @@ func clearAllKeys(t *testing.T) {
 	}
 }
 
+func testAddKey(t *testing.T, store *YubiKeyStore) (data.PrivateKey, error) {
+	privKey, err := GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err)
+
+	err = store.AddKey(privKey.ID(), data.CanonicalRootRole, privKey)
+	return privKey, err
+}
+
 func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
@@ -43,15 +51,14 @@ func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 
 	// create the maximum number of keys
 	for i := 0; i < numSlots; i++ {
-		privKey, err := GenerateECDSAKey(rand.Reader)
+		privKey, err := testAddKey(t, store)
 		assert.NoError(t, err)
-
-		err = store.AddKey(privKey.ID(), data.CanonicalRootRole, privKey)
-		assert.NoError(t, err)
-
 		keys = append(keys, privKey.ID())
 	}
 
+	// create a new store, to make sure we're not just using the keys cache
+	store, err = NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
 	listedKeys := store.ListKeys()
 	assert.Len(t, listedKeys, numSlots)
 	for _, k := range keys {
@@ -60,6 +67,14 @@ func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 		assert.Equal(t, data.CanonicalRootRole, r)
 	}
 
-	// numSlots is not actually the max - some keys might have more, so do not
-	// test that adding more keys will fail.
+	// add another key - should fail because there are no more slots
+	_, err = testAddKey(t, store)
+	assert.Error(t, err)
+
+	// delete one of the middle keys, and assert we can still create a new key
+	err = store.RemoveKey(keys[numSlots/2])
+	assert.NoError(t, err)
+
+	_, err = testAddKey(t, store)
+	assert.NoError(t, err)
 }

From 0280a82ae09463a576a6463c79ed93126b0dd5af Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Sun, 8 Nov 2015 22:54:25 -0800
Subject: [PATCH 52/85] Do not back up a root key that is imported into
 Yubikey.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cmd/notary/integration_test.go    | 44 +++++++++++++++----------------
 cryptoservice/import_export.go    |  4 +--
 passphrase/passphrase.go          | 11 +++++---
 trustmanager/keyfilestore.go      |  3 ++-
 trustmanager/yubikeystore.go      | 29 +++++++++++++++-----
 trustmanager/yubikeystore_test.go | 39 +++++++++++++++++++++++++++
 6 files changed, 96 insertions(+), 34 deletions(-)

diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
index 328ce08e1b..ad3e1c509c 100644
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -178,17 +178,18 @@ func GetKeys(t *testing.T, tempDir string) ([]string, []string) {
 
 // List keys, parses the output, and asserts something about the number of root
 // keys and number of signing keys, as well as returning them.
-func assertNumKeys(t *testing.T, tempDir string, numRoot, numSigning int) (
-	[]string, []string) {
+func assertNumKeys(t *testing.T, tempDir string, numRoot, numSigning int,
+	rootOnDisk bool) ([]string, []string) {
 
 	root, signing := GetKeys(t, tempDir)
 	assert.Len(t, root, numRoot)
 	assert.Len(t, signing, numSigning)
 	for _, rootKeyID := range root {
-		// it should always be present on disk
 		_, err := os.Stat(filepath.Join(
 			tempDir, "private", "root_keys", rootKeyID+"_root.key"))
-		assert.NoError(t, err)
+		// os.IsExist checks to see if the error is because a file already
+		// exist, and hence doesn't actually the right funciton to use here
+		assert.Equal(t, rootOnDisk, !os.IsNotExist(err))
 
 		// this function is declared is in the build-tagged setup files
 		verifyRootKeyOnHardware(t, rootKeyID)
@@ -241,17 +242,17 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	// -- tests --
 
 	// starts out with no keys
-	assertNumKeys(t, tempDir, 0, 0)
+	assertNumKeys(t, tempDir, 0, 0, true)
 
 	// generate root key produces a single root key and no other keys
 	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
 	assert.NoError(t, err)
-	assertNumKeys(t, tempDir, 1, 0)
+	assertNumKeys(t, tempDir, 1, 0, true)
 
 	// initialize a repo, should have signing keys and no new root key
 	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun")
 	assert.NoError(t, err)
-	origRoot, origSign := assertNumKeys(t, tempDir, 1, 2)
+	origRoot, origSign := assertNumKeys(t, tempDir, 1, 2, true)
 
 	// publish using the original keys
 	assertSuccessfullyPublish(t, tempDir, server.URL, "gun", target, tempfiles[0])
@@ -259,7 +260,7 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	// rotate the signing keys
 	_, err = runCommand(t, tempDir, "key", "rotate", "gun")
 	assert.NoError(t, err)
-	root, sign := assertNumKeys(t, tempDir, 1, 4)
+	root, sign := assertNumKeys(t, tempDir, 1, 4, true)
 	assert.Equal(t, origRoot[0], root[0])
 	// there should be the new keys and the old keys
 	for _, origKey := range origSign {
@@ -275,7 +276,7 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	// publish the key rotation
 	_, err = runCommand(t, tempDir, "-s", server.URL, "publish", "gun")
 	assert.NoError(t, err)
-	root, sign = assertNumKeys(t, tempDir, 1, 2)
+	root, sign = assertNumKeys(t, tempDir, 1, 2, true)
 	assert.Equal(t, origRoot[0], root[0])
 	// just do a cursory rotation check that the keys aren't equal anymore
 	for _, origKey := range origSign {
@@ -332,7 +333,7 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 		assertSuccessfullyPublish(
 			t, dirs[0], server.URL, gun, target, tempfiles[0])
 	}
-	assertNumKeys(t, dirs[0], 1, 4)
+	assertNumKeys(t, dirs[0], 1, 4, true)
 
 	// -- tests --
 	zipfile := tempfiles[0] + ".zip"
@@ -344,7 +345,7 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 
 	_, err = runCommand(t, dirs[1], "key", "import", zipfile)
 	assert.NoError(t, err)
-	assertNumKeys(t, dirs[1], 1, 4) // all keys should be there
+	assertNumKeys(t, dirs[1], 1, 4, true) // all keys should be there
 
 	// can list and publish to both repos using imported keys
 	for _, gun := range []string{"gun1", "gun2"} {
@@ -365,16 +366,12 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 
 	// this function is declared is in the build-tagged setup files
 	if rootOnHardware() {
-		// hardware root is still present, but two signing keys moved - we
-		// can't call assertNumKeys, because in this case it will ONLY be on
-		// hardware and not on disk
-		root, signing := GetKeys(t, dirs[2])
-		assert.Len(t, root, 1)
-		verifyRootKeyOnHardware(t, root[0])
-		assert.Len(t, signing, 2)
+		// hardware root is still present, and the key will ONLY be on hardware
+		// and not on disk
+		assertNumKeys(t, dirs[2], 1, 2, false)
 	} else {
 		// only 2 signing keys should be there, and no root key
-		assertNumKeys(t, dirs[2], 0, 2)
+		assertNumKeys(t, dirs[2], 0, 2, true)
 	}
 }
 
@@ -388,7 +385,7 @@ func exportRoot(t *testing.T, exportTo string) string {
 	// generate root key produces a single root key and no other keys
 	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
 	assert.NoError(t, err)
-	oldRoot, _ := assertNumKeys(t, tempDir, 1, 0)
+	oldRoot, _ := assertNumKeys(t, tempDir, 1, 0, true)
 
 	// export does not require a password
 	oldRetriever := retriever
@@ -451,13 +448,16 @@ func TestClientKeyImportExportRootOnly(t *testing.T) {
 	// import the key
 	_, err = runCommand(t, tempDir, "key", "import-root", tempFile.Name())
 	assert.NoError(t, err)
-	newRoot, _ := assertNumKeys(t, tempDir, 1, 0)
+
+	// if there is hardware available, root will only be on hardware, and not
+	// on disk
+	newRoot, _ := assertNumKeys(t, tempDir, 1, 0, !rootOnHardware())
 	assert.Equal(t, rootKeyID, newRoot[0])
 
 	// Just to make sure, init a repo and publish
 	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun")
 	assert.NoError(t, err)
-	assertNumKeys(t, tempDir, 1, 2)
+	assertNumKeys(t, tempDir, 1, 2, !rootOnHardware())
 	assertSuccessfullyPublish(
 		t, tempDir, server.URL, "gun", target, tempFile.Name())
 }
diff --git a/cryptoservice/import_export.go b/cryptoservice/import_export.go
index 922779b789..7ee3ded5ad 100644
--- a/cryptoservice/import_export.go
+++ b/cryptoservice/import_export.go
@@ -112,8 +112,8 @@ func (cs *CryptoService) ImportRootKey(source io.Reader) error {
 
 	for _, ks := range cs.keyStores {
 		// don't redeclare err, we want the value carried out of the loop
-		if err = ks.ImportKey(pemBytes, "root"); err != nil {
-			continue
+		if err = ks.ImportKey(pemBytes, "root"); err == nil {
+			return nil //bail on the first keystore we import to
 		}
 	}
 
diff --git a/passphrase/passphrase.go b/passphrase/passphrase.go
index 3933ff1f71..fdaddce486 100644
--- a/passphrase/passphrase.go
+++ b/passphrase/passphrase.go
@@ -124,12 +124,17 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 			}
 		}
 
+		withID := fmt.Sprintf(" with ID %s", shortName)
+		if shortName == "" {
+			withID = ""
+		}
+
 		if createNew {
-			fmt.Fprintf(out, "Enter passphrase for new %s key with ID %s: ", displayAlias, shortName)
+			fmt.Fprintf(out, "Enter passphrase for new %s key%s: ", displayAlias, withID)
 		} else if displayAlias == "yubikey" {
 			fmt.Fprintf(out, "Enter the %s for the attached Yubikey: ", keyName)
 		} else {
-			fmt.Fprintf(out, "Enter passphrase for %s key with ID %s: ", displayAlias, shortName)
+			fmt.Fprintf(out, "Enter passphrase for %s key%s: ", displayAlias, withID)
 		}
 
 		passphrase, err := stdin.ReadBytes('\n')
@@ -157,7 +162,7 @@ func PromptRetrieverWithInOut(in io.Reader, out io.Writer, aliasMap map[string]s
 			return "", false, ErrTooShort
 		}
 
-		fmt.Fprintf(out, "Repeat passphrase for new %s key with ID %s: ", displayAlias, shortName)
+		fmt.Fprintf(out, "Repeat passphrase for new %s key%s: ", displayAlias, withID)
 		confirmation, err := stdin.ReadBytes('\n')
 		fmt.Fprintln(out)
 		if err != nil {
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index 977e3e6983..18b8969b00 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -347,7 +347,8 @@ func importKey(s LimitedFileStore, passphraseRetriever passphrase.Retriever, cac
 		return s.Add(alias, pemBytes)
 	}
 
-	privKey, passphrase, err := GetPasswdDecryptBytes(passphraseRetriever, pemBytes, "imported", alias)
+	privKey, passphrase, err := GetPasswdDecryptBytes(
+		passphraseRetriever, pemBytes, "", "imported "+alias)
 
 	if err != nil {
 		return err
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index 1544556708..2abd36b45f 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -199,9 +199,11 @@ func addECDSAKey(
 		return fmt.Errorf("error importing: %v", err)
 	}
 
-	err = backupStore.AddKey(privKey.ID(), role, privKey)
-	if err != nil {
-		return ErrBackupFailed{err: err.Error()}
+	if backupStore != nil {
+		err = backupStore.AddKey(privKey.ID(), role, privKey)
+		if err != nil {
+			return ErrBackupFailed{err: err.Error()}
+		}
 	}
 
 	return nil
@@ -551,6 +553,11 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 
 // AddKey puts a key inside the Yubikey, as well as writing it to the backup store
 func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error {
+	return s.addKey(keyID, role, privKey, true)
+}
+
+func (s *YubiKeyStore) addKey(
+	keyID, role string, privKey data.PrivateKey, backup bool) error {
 	// We only allow adding root keys for now
 	if role != data.CanonicalRootRole {
 		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s\n", role, keyID)
@@ -574,7 +581,14 @@ func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error
 		return err
 	}
 	logrus.Debugf("Using yubikey slot %v", slot)
-	err = addECDSAKey(ctx, session, privKey, slot, s.passRetriever, role, s.backupStore)
+
+	backupStore := s.backupStore
+	if !backup {
+		backupStore = nil
+	}
+
+	err = addECDSAKey(
+		ctx, session, privKey, slot, s.passRetriever, role, backupStore)
 	if err == nil {
 		s.keys[privKey.ID()] = yubiSlot{
 			role:   role,
@@ -634,18 +648,21 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	return err
 }
 
+// ExportKey doesn't work, because you can't export data from a Yubikey
 func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
 	logrus.Debugf("Attempting to export: %s key inside of YubiKeyStore", keyID)
 	return nil, errors.New("Keys cannot be exported from a Yubikey.")
 }
 
+// ImportKey imports a root key into a Yubikey
 func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
 	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyID)
-	privKey, _, err := GetPasswdDecryptBytes(s.passRetriever, pemBytes, "imported", "root")
+	privKey, _, err := GetPasswdDecryptBytes(
+		s.passRetriever, pemBytes, "", "imported root")
 	if err != nil {
 		return err
 	}
-	return s.AddKey(privKey.ID(), "root", privKey)
+	return s.addKey(privKey.ID(), "root", privKey, false)
 }
 
 func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikeystore_test.go
index 6c1afe7e93..a2fe904c08 100644
--- a/trustmanager/yubikeystore_test.go
+++ b/trustmanager/yubikeystore_test.go
@@ -63,3 +63,42 @@ func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 	// numSlots is not actually the max - some keys might have more, so do not
 	// test that adding more keys will fail.
 }
+
+// ImportKey imports a key as root without adding it to the backup store
+func TestImportKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	ret := passphrase.ConstantRetriever("passphrase")
+	backup := NewKeyMemoryStore(ret)
+	store, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	// generate key and import it
+	privKey, err := GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err)
+
+	pemBytes, err := EncryptPrivateKey(privKey, "passphrase")
+	assert.NoError(t, err)
+
+	err = store.ImportKey(pemBytes, privKey.ID())
+	assert.NoError(t, err)
+
+	// key is not in backup store
+	_, _, err = backup.GetKey(privKey.ID())
+	assert.Error(t, err)
+
+	// ensure key is in Yubikey -  create a new store, to make sure we're not
+	// just using the keys cache
+	store, err = NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	gottenKey, role, err := store.GetKey(privKey.ID())
+	assert.NoError(t, err)
+	assert.Equal(t, data.CanonicalRootRole, role)
+	assert.Equal(t, privKey.Public(), gottenKey.Public())
+}

From 397adb42916f4a13d5a5b8c13676ef8e97c031df Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Mon, 9 Nov 2015 13:05:52 -0800
Subject: [PATCH 53/85] Pad the ECDSA key that gets put into the Yubikey so it
 has 32 bytes.

Apparently that is required by the template, and will error if it
does not. Sometimes, ECDSA keys are generated which when encoded
seems to only have 31 bytes.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikeystore.go      | 17 ++++++++++++++++-
 trustmanager/yubikeystore_test.go | 27 +++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index d113ca1899..e44bb2ba98 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -30,6 +30,9 @@ const (
 	KeymodeTouch     = 1 // touch enabled
 	KeymodePinOnce   = 2 // require pin entry once
 	KeymodePinAlways = 4 // require pin entry all the time
+
+	// the key size, when importing a key into yubikey, MUST be 32 bytes
+	ecdsaPrivateKeySize = 32
 )
 
 // what key mode to use when generating keys
@@ -136,6 +139,18 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 	return sig, nil
 }
 
+// If a byte array is less than the number of bytes specified by
+// ecdsaPrivateKeySize, left-zero-pad the byte array until
+// it is the required size.
+func ensurePrivateKeySize(payload []byte) []byte {
+	final := payload
+	if len(payload) < ecdsaPrivateKeySize {
+		final = make([]byte, ecdsaPrivateKeySize)
+		copy(final[ecdsaPrivateKeySize-len(payload):], payload)
+	}
+	return final
+}
+
 // addECDSAKey adds a key to the yubikey
 func addECDSAKey(
 	ctx *pkcs11.Ctx,
@@ -161,7 +176,7 @@ func addECDSAKey(
 		return err
 	}
 
-	ecdsaPrivKeyD := ecdsaPrivKey.D.Bytes()
+	ecdsaPrivKeyD := ensurePrivateKeySize(ecdsaPrivKey.D.Bytes())
 	logrus.Debugf("Getting D bytes: %v\n", ecdsaPrivKeyD)
 
 	template, err := NewCertificate(role)
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikeystore_test.go
index 4aac0c0ec8..b769404cc4 100644
--- a/trustmanager/yubikeystore_test.go
+++ b/trustmanager/yubikeystore_test.go
@@ -4,6 +4,7 @@ package trustmanager
 
 import (
 	"crypto/rand"
+	"reflect"
 	"testing"
 
 	"github.com/docker/notary/passphrase"
@@ -25,6 +26,32 @@ func clearAllKeys(t *testing.T) {
 	}
 }
 
+func TestEnsurePrivateKeySizePassesThroughRightSizeArrays(t *testing.T) {
+	fullByteArray := make([]byte, ecdsaPrivateKeySize)
+	for i := range fullByteArray {
+		fullByteArray[i] = byte(1)
+	}
+
+	result := ensurePrivateKeySize(fullByteArray)
+	assert.True(t, reflect.DeepEqual(fullByteArray, result))
+}
+
+// The pad32Byte helper function left zero-pads byte arrays that are less than
+// ecdsaPrivateKeySize bytes
+func TestEnsurePrivateKeySizePadsLessThanRequiredSizeArrays(t *testing.T) {
+	shortByteArray := make([]byte, ecdsaPrivateKeySize/2)
+	for i := range shortByteArray {
+		shortByteArray[i] = byte(1)
+	}
+
+	expected := append(
+		make([]byte, ecdsaPrivateKeySize-ecdsaPrivateKeySize/2),
+		shortByteArray...)
+
+	result := ensurePrivateKeySize(shortByteArray)
+	assert.True(t, reflect.DeepEqual(expected, result))
+}
+
 func testAddKey(t *testing.T, store *YubiKeyStore) (data.PrivateKey, error) {
 	privKey, err := GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err)

From d2ca58bbf48ba0b27ccc66d306e2f340ade60cca Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Mon, 9 Nov 2015 16:46:42 -0800
Subject: [PATCH 54/85] use the slots on the yubikey in the following order:
 9c, 9e, 9d, 9a Signed-off-by: David Lawrence <david.lawrence@docker.com>
 (github: endophage)

---
 trustmanager/yubikeystore.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index e44bb2ba98..d7d44fcbba 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -36,7 +36,10 @@ const (
 )
 
 // what key mode to use when generating keys
-var yubikeyKeymode = KeymodeTouch | KeymodePinOnce
+var (
+	yubikeyKeymode = KeymodeTouch | KeymodePinOnce
+	slotIDs        = []int{2, 1, 3, 0}
+)
 
 // SetYubikeyKeyMode - sets the mode when generating yubikey keys.
 // This is to be used for testing.  It does nothing if not building with tag
@@ -522,7 +525,7 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 			}
 		}
 	}
-	for i := 0; i < numSlots; i++ {
+	for _, i := range slotIDs {
 		if !taken[i] {
 			return []byte{byte(i)}, nil
 		}

From e0c5bb7b83e0e2a0e1af47ae7cd77db421228fc7 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Mon, 9 Nov 2015 16:53:32 -0800
Subject: [PATCH 55/85] comment about token location ordering Signed-off-by:
 David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 trustmanager/yubikeystore.go | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index d7d44fcbba..c657b99823 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -38,7 +38,9 @@ const (
 // what key mode to use when generating keys
 var (
 	yubikeyKeymode = KeymodeTouch | KeymodePinOnce
-	slotIDs        = []int{2, 1, 3, 0}
+	// order in which to prefer token locations on the yubikey.
+	// corresponds to: 9c, 9e, 9d, 9a
+	slotIDs = []int{2, 1, 3, 0}
 )
 
 // SetYubikeyKeyMode - sets the mode when generating yubikey keys.
@@ -525,9 +527,11 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 			}
 		}
 	}
-	for _, i := range slotIDs {
-		if !taken[i] {
-			return []byte{byte(i)}, nil
+	// iterate the token locations in our preferred order and use the first
+	// available one. Otherwise exit the loop and return an error.
+	for _, loc := range slotIDs {
+		if !taken[loc] {
+			return []byte{byte(loc)}, nil
 		}
 	}
 	return nil, errors.New("Yubikey has no available slots.")

From f9f118d08826fa27e2dcbd32a45c5005d39b0302 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo.monica@gmail.com>
Date: Mon, 9 Nov 2015 17:29:53 -0800
Subject: [PATCH 56/85] Changing env to be TARGETS

Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo.monica@gmail.com> (github: endophage)
---
 cmd/notary/main.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index da2176188c..78791f80b0 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -145,7 +145,7 @@ func getPassphraseRetriever() passphrase.Retriever {
 	baseRetriever := passphrase.PromptRetriever()
 	env := map[string]string{
 		"root":     os.Getenv("NOTARY_ROOT_PASSPHRASE"),
-		"targets":  os.Getenv("NOTARY_TARGET_PASSPHRASE"),
+		"targets":  os.Getenv("NOTARY_TARGETS_PASSPHRASE"),
 		"snapshot": os.Getenv("NOTARY_SNAPSHOT_PASSPHRASE"),
 	}
 

From c08e732f9faf717953dcc2a645af4e42b698670d Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Mon, 9 Nov 2015 23:16:09 -0800
Subject: [PATCH 57/85] fixing error message and moving signing operations up a
 level Signed-off-by: David Lawrence <david.lawrence@docker.com> (github:
 endophage)

---
 cryptoservice/crypto_service.go |  14 +-
 tuf/signed/ed25519.go           |  15 +-
 tuf/signed/errors.go            |  11 ++
 tuf/signed/sign.go              |  73 ++++-----
 tuf/signed/sign_test.go         | 110 +++++++-------
 tuf/signed/verify.go            |   4 +-
 tuf/signed/verify_test.go       | 256 ++++++++++++++++++++------------
 7 files changed, 270 insertions(+), 213 deletions(-)

diff --git a/cryptoservice/crypto_service.go b/cryptoservice/crypto_service.go
index e825a3d462..da14d75d0c 100644
--- a/cryptoservice/crypto_service.go
+++ b/cryptoservice/crypto_service.go
@@ -116,12 +116,10 @@ func (cs *CryptoService) RemoveKey(keyID string) (err error) {
 // signatures is adequate.
 func (cs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature, error) {
 	signatures := make([]data.Signature, 0, len(keyIDs))
-	for _, keyid := range keyIDs {
-		keyName := keyid
-
-		privKey, _, err := cs.GetPrivateKey(keyName)
+	for _, keyID := range keyIDs {
+		privKey, _, err := cs.GetPrivateKey(keyID)
 		if err != nil {
-			logrus.Debugf("error attempting to retrieve private key: %s, %v", keyid, err)
+			logrus.Debugf("error attempting to retrieve private key: %s, %v", keyID, err)
 			continue
 		}
 
@@ -129,15 +127,15 @@ func (cs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signature
 		sig, err := privKey.Sign(rand.Reader, payload, nil)
 		if err != nil {
 			logrus.Debugf("ignoring error attempting to %s sign with keyID: %s, %v",
-				privKey.Algorithm(), keyid, err)
+				privKey.Algorithm(), keyID, err)
 			continue
 		}
 
-		logrus.Debugf("appending %s signature with Key ID: %s", privKey.Algorithm(), keyid)
+		logrus.Debugf("appending %s signature with Key ID: %s", privKey.Algorithm(), keyID)
 
 		// Append signatures to result array
 		signatures = append(signatures, data.Signature{
-			KeyID:     keyid,
+			KeyID:     keyID,
 			Method:    sigAlgo,
 			Signature: sig[:],
 		})
diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index dc5ea00f23..3fca65b3dd 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -7,6 +7,7 @@ import (
 	"io/ioutil"
 
 	"github.com/agl/ed25519"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 )
 
@@ -83,18 +84,13 @@ func (e *Ed25519) Create(role, algorithm string) (data.PublicKey, error) {
 		return nil, errors.New("only ED25519 supported by this cryptoservice")
 	}
 
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	public := data.NewED25519PublicKey(pub[:])
-	private, err := data.NewED25519PrivateKey(*public, priv[:])
+	private, err := trustmanager.GenerateED25519Key(rand.Reader)
 	if err != nil {
 		return nil, err
 	}
 
 	e.addKey(role, private)
-	return public, nil
+	return data.PublicKeyFromPrivate(private), nil
 }
 
 // PublicKeys returns a map of public keys for the ids provided, when those IDs are found
@@ -116,7 +112,10 @@ func (e *Ed25519) GetKey(keyID string) data.PublicKey {
 
 // GetPrivateKey returns a single private key based on the ID
 func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
-	return e.keys[keyID].privKey, "", nil
+	if k, ok := e.keys[keyID]; ok {
+		return k.privKey, k.role, nil
+	}
+	return nil, "", errors.New("Key not found " + keyID)
 }
 
 // ImportRootKey adds an Ed25519 key to the store as a root key
diff --git a/tuf/signed/errors.go b/tuf/signed/errors.go
index 6cddcf2ba4..346b18849b 100644
--- a/tuf/signed/errors.go
+++ b/tuf/signed/errors.go
@@ -2,6 +2,7 @@ package signed
 
 import (
 	"fmt"
+	"strings"
 )
 
 // ErrInsufficientSignatures - do not have enough signatures on a piece of
@@ -59,3 +60,13 @@ type ErrInvalidKeyLength struct {
 func (e ErrInvalidKeyLength) Error() string {
 	return fmt.Sprintf("key length is not supported: %s", e.msg)
 }
+
+// ErrNoKeys indicates no signing keys were found when trying to sign
+type ErrNoKeys struct {
+	keyIDs []string
+}
+
+func (e ErrNoKeys) Error() string {
+	return fmt.Sprintf("could not find necessary signing keys, at least one of these keys must be available: %s",
+		strings.Join(e.keyIDs, ", "))
+}
diff --git a/tuf/signed/sign.go b/tuf/signed/sign.go
index 48a6efd7f0..42e051d4e9 100644
--- a/tuf/signed/sign.go
+++ b/tuf/signed/sign.go
@@ -12,6 +12,7 @@ package signed
 // for which the root key is wrapped using an x509 certificate.
 
 import (
+	"crypto/rand"
 	"fmt"
 
 	"github.com/Sirupsen/logrus"
@@ -19,62 +20,62 @@ import (
 	"github.com/docker/notary/tuf/utils"
 )
 
-type idPair struct {
-	scopedKeyID    string
-	canonicalKeyID string
-}
-
 // Sign takes a data.Signed and a key, calculated and adds the signature
 // to the data.Signed
 func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
 	logrus.Debugf("sign called with %d keys", len(keys))
 	signatures := make([]data.Signature, 0, len(s.Signatures)+1)
-	keyIDMemb := make(map[string]struct{})
-	keyIDs := make(
-		[]idPair,
-		0,
-		len(keys),
-	)
+	signingKeyIDs := make(map[string]struct{})
+	ids := make([]string, 0, len(keys))
 
+	privKeys := make(map[string]data.PrivateKey)
+
+	// Get all the private key objects related to the public keys
 	for _, key := range keys {
-		keyID, err := utils.CanonicalKeyID(key)
+		canonicalID, err := utils.CanonicalKeyID(key)
+		ids = append(ids, canonicalID)
 		if err != nil {
 			continue
 		}
-		keyIDMemb[key.ID()] = struct{}{}
-		keyIDs = append(keyIDs, idPair{
-			scopedKeyID:    key.ID(),
-			canonicalKeyID: keyID,
+		k, _, err := service.GetPrivateKey(canonicalID)
+		if err != nil {
+			continue
+		}
+		privKeys[key.ID()] = k
+	}
+
+	// Check to ensure we have at least on signing key
+	if len(privKeys) == 0 {
+		return ErrNoKeys{keyIDs: ids}
+	}
+
+	// Do signing and generate list of signatures
+	for keyID, pk := range privKeys {
+		sig, err := pk.Sign(rand.Reader, s.Signed, nil)
+		if err != nil {
+			logrus.Debugf("Failed to sign with key: %s. Reason: %v", keyID, err)
+			continue
+		}
+		signingKeyIDs[keyID] = struct{}{}
+		signatures = append(signatures, data.Signature{
+			KeyID:     keyID,
+			Method:    pk.SignatureAlgorithm(),
+			Signature: sig[:],
 		})
 	}
 
-	// we need to ask the signer to sign with the canonical key ID
-	// (ID of the TUF key's public key bytes only), but
-	// we need to translate back to the scoped key ID (the hash of the TUF key
-	// with the full PEM bytes) before giving the
-	// signature back to TUF.
-	for _, pair := range keyIDs {
-		newSigs, err := service.Sign([]string{pair.canonicalKeyID}, s.Signed)
-		if err != nil {
-			return err
-		}
-		// we only asked to sign with 1 key ID, so there will either be 1
-		// or zero signatures
-		if len(newSigs) == 1 {
-			newSig := newSigs[0]
-			newSig.KeyID = pair.scopedKeyID
-			signatures = append(signatures, newSig)
-		}
-	}
+	// Check we produced at least on signature
 	if len(signatures) < 1 {
 		return ErrInsufficientSignatures{
 			Name: fmt.Sprintf(
 				"Cryptoservice failed to produce any signatures for keys with IDs: %v",
-				keyIDs),
+				ids),
 		}
 	}
+
 	for _, sig := range s.Signatures {
-		if _, ok := keyIDMemb[sig.KeyID]; ok {
+		if _, ok := signingKeyIDs[sig.KeyID]; ok {
+			// key is in the set of key IDs for which a signature has been created
 			continue
 		}
 		signatures = append(signatures, sig)
diff --git a/tuf/signed/sign_test.go b/tuf/signed/sign_test.go
index 9b809bde3e..6e404956aa 100644
--- a/tuf/signed/sign_test.go
+++ b/tuf/signed/sign_test.go
@@ -2,7 +2,6 @@ package signed
 
 import (
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
@@ -17,13 +16,10 @@ import (
 const (
 	testKeyPEM1 = "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAnKuXZeefa2LmgxaL5NsM\nzKOHNe+x/nL6ik+lDBCTV6OdcwAhHQS+PONGhrChIUVR6Vth3hUCrreLzPO73Oo5\nVSCuRJ53UronENl6lsa5mFKP8StYLvIDITNvkoT3j52BJIjyNUK9UKY9As2TNqDf\nBEPIRp28ev/NViwGOEkBu2UAbwCIdnDXm8JQErCZA0Ydm7PKGgjLbFsFGrVzqXHK\n6pdzJXlhr9yap3UpgQ/iO9JtoEYB2EXsnSrPc9JRjR30bNHHtnVql3fvinXrAEwq\n3xmN4p+R4VGzfdQN+8Kl/IPjqWB535twhFYEG/B7Ze8IwbygBjK3co/KnOPqMUrM\nBI8ztvPiogz+MvXb8WvarZ6TMTh8ifZI96r7zzqyzjR1hJulEy3IsMGvz8XS2J0X\n7sXoaqszEtXdq5ef5zKVxkiyIQZcbPgmpHLq4MgfdryuVVc/RPASoRIXG4lKaTJj\n1ANMFPxDQpHudCLxwCzjCb+sVa20HBRPTnzo8LSZkI6jAgMBAAE=\n-----END PUBLIC KEY-----"
 	testKeyID1  = "51324b59d4888faa91219ebbe5a3876bb4efb21f0602ddf363cd4c3996ded3d4"
-
-	testKeyPEM2 = "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEArvqUPYb6JJROPJQglPTj\n5uDrsxQKl34Mo+3pSlBVuD6puE4lDnG649a2YksJy+C8ZIPJgokn5w+C3alh+dMe\nzbdWHHxrY1h9CLpYz5cbMlE16303ubkt1rvwDqEezG0HDBzPaKj4oP9YJ9x7wbsq\ndvFcy+Qc3wWd7UWcieo6E0ihbJkYcY8chRXVLg1rL7EfZ+e3bq5+ojA2ECM5JqzZ\nzgDpqCv5hTCYYZp72MZcG7dfSPAHrcSGIrwg7whzz2UsEtCOpsJTuCl96FPN7kAu\n4w/WyM3+SPzzr4/RQXuY1SrLCFD8ebM2zHt/3ATLhPnGmyG5I0RGYoegFaZ2AViw\nlqZDOYnBtgDvKP0zakMtFMbkh2XuNBUBO7Sjs0YcZMjLkh9gYUHL1yWS3Aqus1Lw\nlI0gHS22oyGObVBWkZEgk/Foy08sECLGao+5VvhmGpfVuiz9OKFUmtPVjWzRE4ng\niekEu4drSxpH41inLGSvdByDWLpcTvWQI9nkgclh3AT/AgMBAAE=\n-----END PUBLIC KEY-----"
-	testKeyID2  = "26f2f5c0fbfa98823bf1ad39d5f3b32575895793baf80f1df675597d5b95dba8"
 )
 
 type FailingCryptoService struct {
-	testKey data.PublicKey
+	testKey data.PrivateKey
 }
 
 func (mts *FailingCryptoService) Sign(keyIDs []string, _ []byte) ([]data.Signature, error) {
@@ -50,13 +46,16 @@ func (mts *FailingCryptoService) ListAllKeys() map[string]string {
 
 func (mts *FailingCryptoService) GetKey(keyID string) data.PublicKey {
 	if keyID == "testID" {
-		return mts.testKey
+		return data.PublicKeyFromPrivate(mts.testKey)
 	}
 	return nil
 }
 
 func (mts *FailingCryptoService) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
-	return nil, "", errors.New("Not implemented")
+	if mts.testKey != nil {
+		return mts.testKey, "testRole", nil
+	}
+	return nil, "", errors.New("Key not found " + keyID)
 }
 
 func (mts *FailingCryptoService) RemoveKey(keyID string) error {
@@ -68,7 +67,7 @@ func (mts *FailingCryptoService) ImportRootKey(r io.Reader) error {
 }
 
 type MockCryptoService struct {
-	testKey data.PublicKey
+	testKey data.PrivateKey
 }
 
 func (mts *MockCryptoService) Sign(keyIDs []string, _ []byte) ([]data.Signature, error) {
@@ -85,7 +84,7 @@ func (mts *MockCryptoService) Create(_ string, _ string) (data.PublicKey, error)
 
 func (mts *MockCryptoService) GetKey(keyID string) data.PublicKey {
 	if keyID == "testID" {
-		return mts.testKey
+		return data.PublicKeyFromPrivate(mts.testKey)
 	}
 	return nil
 }
@@ -104,7 +103,7 @@ func (mts *MockCryptoService) ListAllKeys() map[string]string {
 }
 
 func (mts *MockCryptoService) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
-	return nil, "", errors.New("Not implemented")
+	return mts.testKey, "testRole", nil
 }
 
 func (mts *MockCryptoService) RemoveKey(keyID string) error {
@@ -133,7 +132,7 @@ func (mts *StrictMockCryptoService) Sign(keyIDs []string, _ []byte) ([]data.Sign
 
 func (mts *StrictMockCryptoService) GetKey(keyID string) data.PublicKey {
 	if keyID == mts.testKey.ID() {
-		return mts.testKey
+		return data.PublicKeyFromPrivate(mts.testKey)
 	}
 	return nil
 }
@@ -157,70 +156,80 @@ func (mts *StrictMockCryptoService) ImportRootKey(r io.Reader) error {
 
 // Test signing and ensure the expected signature is added
 func TestBasicSign(t *testing.T) {
-	testKey, _ := pem.Decode([]byte(testKeyPEM1))
-	k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	mockCryptoService := &MockCryptoService{testKey: k}
-	key, err := mockCryptoService.Create("root", data.ED25519Key)
-	if err != nil {
-		t.Fatal(err)
-	}
+	cs := NewEd25519()
+	key, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
 	testData := data.Signed{}
 
-	Sign(mockCryptoService, &testData, key)
+	err = Sign(cs, &testData, key)
+	assert.NoError(t, err)
 
 	if len(testData.Signatures) != 1 {
 		t.Fatalf("Incorrect number of signatures: %d", len(testData.Signatures))
 	}
 
-	if testData.Signatures[0].KeyID != testKeyID1 {
+	if testData.Signatures[0].KeyID != key.ID() {
 		t.Fatalf("Wrong signature ID returned: %s", testData.Signatures[0].KeyID)
 	}
 }
 
-// Test signing with the same key multiple times only registers a single signature
-// for the key (N.B. MockCryptoService.Sign will still be called again, but Signer.Sign
-// should be cleaning previous signatures by the KeyID when asked to sign again)
+// Signing with the same key multiple times should not produce multiple sigs
+// with the same key ID
 func TestReSign(t *testing.T) {
-	testKey, _ := pem.Decode([]byte(testKeyPEM1))
-	k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	mockCryptoService := &MockCryptoService{testKey: k}
+	cs := NewEd25519()
+	key, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
 	testData := data.Signed{}
 
-	Sign(mockCryptoService, &testData, k)
-	Sign(mockCryptoService, &testData, k)
+	Sign(cs, &testData, key)
+	Sign(cs, &testData, key)
 
 	if len(testData.Signatures) != 1 {
 		t.Fatalf("Incorrect number of signatures: %d", len(testData.Signatures))
 	}
 
-	if testData.Signatures[0].KeyID != testKeyID1 {
+	if testData.Signatures[0].KeyID != key.ID() {
 		t.Fatalf("Wrong signature ID returned: %s", testData.Signatures[0].KeyID)
 	}
 
 }
 
+// Should not remove signatures for valid keys that were not resigned with
 func TestMultiSign(t *testing.T) {
-	mockCryptoService := &MockCryptoService{}
+	cs := NewEd25519()
 	testData := data.Signed{}
 
-	testKey, _ := pem.Decode([]byte(testKeyPEM1))
-	key := data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	Sign(mockCryptoService, &testData, key)
+	key1, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	Sign(cs, &testData, key1)
 
-	testKey, _ = pem.Decode([]byte(testKeyPEM2))
-	key = data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	Sign(mockCryptoService, &testData, key)
+	// reinitializing cs means it won't know about key1. We want
+	// to attempt to sign passing both key1 and key2, while expecting
+	// that the signature for key1 is left intact and the signature
+	// for key2 is added
+	cs = NewEd25519()
+	key2, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	Sign(
+		cs,
+		&testData,
+		key1,
+		key2,
+	)
 
 	if len(testData.Signatures) != 2 {
 		t.Fatalf("Incorrect number of signatures: %d", len(testData.Signatures))
 	}
 
-	keyIDs := map[string]struct{}{testKeyID1: {}, testKeyID2: {}}
+	keyIDs := map[string]struct{}{key1.ID(): {}, key2.ID(): {}}
+	count := 0
 	for _, sig := range testData.Signatures {
+		count++
 		if _, ok := keyIDs[sig.KeyID]; !ok {
 			t.Fatalf("Got a signature we didn't expect: %s", sig.KeyID)
 		}
 	}
+	assert.Equal(t, 2, count)
 
 }
 
@@ -240,32 +249,18 @@ func TestSignReturnsNoSigs(t *testing.T) {
 	}
 }
 
-func TestCreate(t *testing.T) {
-	testKey, _ := pem.Decode([]byte(testKeyPEM1))
-	k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	mockCryptoService := &MockCryptoService{testKey: k}
-
-	key, err := mockCryptoService.Create("root", data.ED25519Key)
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	if key.ID() != testKeyID1 {
-		t.Fatalf("Expected key ID not found: %s", key.ID())
-	}
-}
-
 func TestSignWithX509(t *testing.T) {
 	// generate a key becase we need a cert
-	privKey, err := rsa.GenerateKey(rand.Reader, 1024)
+	privKey, err := trustmanager.GenerateRSAKey(rand.Reader, 1024)
 	assert.NoError(t, err)
 
 	// make a RSA x509 key
 	template, err := trustmanager.NewCertificate("test")
 	assert.NoError(t, err)
 
+	signer := privKey.CryptoSigner()
 	derBytes, err := x509.CreateCertificate(
-		rand.Reader, template, template, &privKey.PublicKey, privKey)
+		rand.Reader, template, template, signer.Public(), signer)
 	assert.NoError(t, err)
 
 	cert, err := x509.ParseCertificate(derBytes)
@@ -274,14 +269,9 @@ func TestSignWithX509(t *testing.T) {
 	tufRSAx509Key := trustmanager.CertToKey(cert)
 	assert.NoError(t, err)
 
-	// make a data.PublicKey from the generated private key
-	pubBytes, err := x509.MarshalPKIXPublicKey(&privKey.PublicKey)
-	assert.NoError(t, err)
-	tufRSAKey := data.NewPublicKey(data.RSAKey, pubBytes)
-
 	// test signing against a service that only recognizes a RSAKey (not
 	// RSAx509 key)
-	mockCryptoService := &StrictMockCryptoService{MockCryptoService{tufRSAKey}}
+	mockCryptoService := &StrictMockCryptoService{MockCryptoService{privKey}}
 	testData := data.Signed{}
 	err = Sign(mockCryptoService, &testData, tufRSAx509Key)
 	assert.NoError(t, err)
diff --git a/tuf/signed/verify.go b/tuf/signed/verify.go
index 1b74f83f93..3c1646f81f 100644
--- a/tuf/signed/verify.go
+++ b/tuf/signed/verify.go
@@ -65,10 +65,10 @@ func VerifyRoot(s *data.Signed, minVersion int, keys map[string]data.PublicKey)
 // Verify checks the signatures and metadata (expiry, version) for the signed role
 // data
 func Verify(s *data.Signed, role string, minVersion int, db *keys.KeyDB) error {
-	if err := VerifySignatures(s, role, db); err != nil {
+	if err := verifyMeta(s, role, minVersion); err != nil {
 		return err
 	}
-	return verifyMeta(s, role, minVersion)
+	return VerifySignatures(s, role, db)
 }
 
 func verifyMeta(s *data.Signed, role string, minVersion int) error {
diff --git a/tuf/signed/verify_test.go b/tuf/signed/verify_test.go
index 233bbb61e1..4c7bbc270b 100644
--- a/tuf/signed/verify_test.go
+++ b/tuf/signed/verify_test.go
@@ -1,16 +1,160 @@
 package signed
 
 import (
+	"errors"
 	"testing"
 	"time"
 
+	"github.com/jfrazelle/go/canonical/json"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/docker/notary/tuf/data"
 	"github.com/docker/notary/tuf/keys"
-	"github.com/jfrazelle/go/canonical/json"
 )
 
+func TestRoleNoKeys(t *testing.T) {
+	cs := NewEd25519()
+	k, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	r, err := data.NewRole(
+		"root",
+		1,
+		[]string{},
+		nil,
+		nil,
+	)
+	assert.NoError(t, err)
+	db := keys.NewDB()
+	assert.NoError(t, err)
+	err = db.AddRole(r)
+	assert.NoError(t, err)
+	meta := &data.SignedCommon{Type: "Root", Version: 1, Expires: data.DefaultExpires("root")}
+
+	b, err := json.MarshalCanonical(meta)
+	assert.NoError(t, err)
+	s := &data.Signed{Signed: b}
+	Sign(cs, s, k)
+	err = Verify(s, "root", 1, db)
+	assert.IsType(t, ErrRoleThreshold{}, err)
+}
+
+func TestNotEnoughSigs(t *testing.T) {
+	cs := NewEd25519()
+	k, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	r, err := data.NewRole(
+		"root",
+		2,
+		[]string{k.ID()},
+		nil,
+		nil,
+	)
+	assert.NoError(t, err)
+	db := keys.NewDB()
+	assert.NoError(t, err)
+	db.AddKey(k)
+	err = db.AddRole(r)
+	assert.NoError(t, err)
+	meta := &data.SignedCommon{Type: "Root", Version: 1, Expires: data.DefaultExpires("root")}
+
+	b, err := json.MarshalCanonical(meta)
+	assert.NoError(t, err)
+	s := &data.Signed{Signed: b}
+	Sign(cs, s, k)
+	err = Verify(s, "root", 1, db)
+	assert.IsType(t, ErrRoleThreshold{}, err)
+}
+
+func TestMoreThanEnoughSigs(t *testing.T) {
+	cs := NewEd25519()
+	k1, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	k2, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	r, err := data.NewRole(
+		"root",
+		1,
+		[]string{k1.ID(), k2.ID()},
+		nil,
+		nil,
+	)
+	assert.NoError(t, err)
+	db := keys.NewDB()
+	assert.NoError(t, err)
+	db.AddKey(k1)
+	db.AddKey(k2)
+	err = db.AddRole(r)
+	assert.NoError(t, err)
+	meta := &data.SignedCommon{Type: "Root", Version: 1, Expires: data.DefaultExpires("root")}
+
+	b, err := json.MarshalCanonical(meta)
+	assert.NoError(t, err)
+	s := &data.Signed{Signed: b}
+	Sign(cs, s, k1, k2)
+	assert.Equal(t, 2, len(s.Signatures))
+	err = Verify(s, "root", 1, db)
+	assert.NoError(t, err)
+}
+
+func TestDuplicateSigs(t *testing.T) {
+	cs := NewEd25519()
+	k, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	r, err := data.NewRole(
+		"root",
+		2,
+		[]string{k.ID()},
+		nil,
+		nil,
+	)
+	assert.NoError(t, err)
+	db := keys.NewDB()
+	assert.NoError(t, err)
+	db.AddKey(k)
+	err = db.AddRole(r)
+	assert.NoError(t, err)
+	meta := &data.SignedCommon{Type: "Root", Version: 1, Expires: data.DefaultExpires("root")}
+
+	b, err := json.MarshalCanonical(meta)
+	assert.NoError(t, err)
+	s := &data.Signed{Signed: b}
+	Sign(cs, s, k)
+	s.Signatures = append(s.Signatures, s.Signatures[0])
+	err = Verify(s, "root", 1, db)
+	assert.IsType(t, ErrRoleThreshold{}, err)
+}
+
+func TestUnknownKeyBelowThreshold(t *testing.T) {
+	cs := NewEd25519()
+	k, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	unknown, err := cs.Create("root", data.ED25519Key)
+	assert.NoError(t, err)
+	r, err := data.NewRole(
+		"root",
+		2,
+		[]string{k.ID()},
+		nil,
+		nil,
+	)
+	assert.NoError(t, err)
+	db := keys.NewDB()
+	assert.NoError(t, err)
+	db.AddKey(k)
+	db.AddKey(unknown)
+	err = db.AddRole(r)
+	assert.NoError(t, err)
+	meta := &data.SignedCommon{Type: "Root", Version: 1, Expires: data.DefaultExpires("root")}
+
+	b, err := json.MarshalCanonical(meta)
+	assert.NoError(t, err)
+	s := &data.Signed{Signed: b}
+	Sign(cs, s, k, unknown)
+	s.Signatures = append(s.Signatures)
+	err = Verify(s, "root", 1, db)
+	assert.IsType(t, ErrRoleThreshold{}, err)
+}
+
 func Test(t *testing.T) {
 	cryptoService := NewEd25519()
 	type test struct {
@@ -37,87 +181,11 @@ func Test(t *testing.T) {
 		{
 			name: "unknown role",
 			role: "foo",
-			err:  ErrUnknownRole,
-		},
-		//{
-		//	name: "wrong signature method",
-		//	mut:  func(t *test) { t.s.Signatures[0].Method = "foo" },
-		//	err:  ErrWrongMethod,
-		//},
-		//	{
-		//		name: "signature wrong length",
-		//		mut:  func(t *test) { t.s.Signatures[0].Signature = []byte{0} },
-		//		err:  ErrInvalid,
-		//	},
-		{
-			name: "key missing from role",
-			mut:  func(t *test) { t.roles["root"].KeyIDs = nil },
-			err:  ErrRoleThreshold{},
-		},
-		//	{
-		//		name: "invalid signature",
-		//		mut:  func(t *test) { t.s.Signatures[0].Signature = make([]byte, ed25519.SignatureSize) },
-		//		err:  ErrInvalid,
-		//	},
-		{
-			name: "not enough signatures",
-			mut:  func(t *test) { t.roles["root"].Threshold = 2 },
-			err:  ErrRoleThreshold{},
+			err:  errors.New("tuf: meta file has wrong type"),
 		},
 		{
 			name: "exactly enough signatures",
 		},
-		{
-			name: "more than enough signatures",
-			mut: func(t *test) {
-				k, _ := cryptoService.Create("root", data.ED25519Key)
-				Sign(cryptoService, t.s, k)
-				t.keys = append(t.keys, k)
-				t.roles["root"].KeyIDs = append(t.roles["root"].KeyIDs, k.ID())
-			},
-		},
-		{
-			name: "duplicate key id",
-			mut: func(t *test) {
-				t.roles["root"].Threshold = 2
-				t.s.Signatures = append(t.s.Signatures, t.s.Signatures[0])
-			},
-			err: ErrRoleThreshold{},
-		},
-		{
-			name: "unknown key",
-			mut: func(t *test) {
-				k, _ := cryptoService.Create("root", data.ED25519Key)
-				Sign(cryptoService, t.s, k)
-			},
-		},
-		{
-			name: "unknown key below threshold",
-			mut: func(t *test) {
-				k, _ := cryptoService.Create("root", data.ED25519Key)
-				Sign(cryptoService, t.s, k)
-				t.roles["root"].Threshold = 2
-			},
-			err: ErrRoleThreshold{},
-		},
-		{
-			name: "unknown keys in db",
-			mut: func(t *test) {
-				k, _ := cryptoService.Create("root", data.ED25519Key)
-				Sign(cryptoService, t.s, k)
-				t.keys = append(t.keys, k)
-			},
-		},
-		{
-			name: "unknown keys in db below threshold",
-			mut: func(t *test) {
-				k, _ := cryptoService.Create("root", data.ED25519Key)
-				Sign(cryptoService, t.s, k)
-				t.keys = append(t.keys, k)
-				t.roles["root"].Threshold = 2
-			},
-			err: ErrRoleThreshold{},
-		},
 		{
 			name: "wrong type",
 			typ:  "bar",
@@ -136,6 +204,7 @@ func Test(t *testing.T) {
 		},
 	}
 	for _, run := range tests {
+		db := keys.NewDB()
 		if run.role == "" {
 			run.role = "root"
 		}
@@ -151,6 +220,16 @@ func Test(t *testing.T) {
 		}
 		if run.keys == nil && run.s == nil {
 			k, _ := cryptoService.Create("root", data.ED25519Key)
+			db.AddKey(k)
+			r, err := data.NewRole(
+				"root",
+				1,
+				[]string{k.ID()},
+				nil,
+				nil,
+			)
+			assert.NoError(t, err)
+			db.AddRole(r)
 			meta := &data.SignedCommon{Type: run.typ, Version: run.ver, Expires: *run.exp}
 
 			b, err := json.MarshalCanonical(meta)
@@ -158,32 +237,11 @@ func Test(t *testing.T) {
 			s := &data.Signed{Signed: b}
 			Sign(cryptoService, s, k)
 			run.s = s
-			run.keys = []data.PublicKey{k}
-		}
-		if run.roles == nil {
-			run.roles = map[string]*data.Role{
-				"root": {
-					RootRole: data.RootRole{
-						KeyIDs:    []string{run.keys[0].ID()},
-						Threshold: 1,
-					},
-					Name: "root",
-				},
-			}
 		}
 		if run.mut != nil {
 			run.mut(&run)
 		}
 
-		db := keys.NewDB()
-		for _, k := range run.keys {
-			db.AddKey(k)
-		}
-		for _, r := range run.roles {
-			err := db.AddRole(r)
-			assert.NoError(t, err)
-		}
-
 		err := Verify(run.s, run.role, minVer, db)
 		if e, ok := run.err.(ErrExpired); ok {
 			assertErrExpired(t, err, e)

From 05c5615187703b281f02c86663c4cb7a2cc22778 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 11:01:54 -0800
Subject: [PATCH 58/85] updating per Diogo's comments Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 tuf/signed/ed25519.go   | 2 +-
 tuf/signed/sign.go      | 4 ++--
 tuf/signed/sign_test.go | 3 +--
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/tuf/signed/ed25519.go b/tuf/signed/ed25519.go
index 3fca65b3dd..425b063bd5 100644
--- a/tuf/signed/ed25519.go
+++ b/tuf/signed/ed25519.go
@@ -115,7 +115,7 @@ func (e *Ed25519) GetPrivateKey(keyID string) (data.PrivateKey, string, error) {
 	if k, ok := e.keys[keyID]; ok {
 		return k.privKey, k.role, nil
 	}
-	return nil, "", errors.New("Key not found " + keyID)
+	return nil, "", trustmanager.ErrKeyNotFound{KeyID: keyID}
 }
 
 // ImportRootKey adds an Ed25519 key to the store as a root key
diff --git a/tuf/signed/sign.go b/tuf/signed/sign.go
index 42e051d4e9..6c4d2eb73f 100644
--- a/tuf/signed/sign.go
+++ b/tuf/signed/sign.go
@@ -44,7 +44,7 @@ func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
 		privKeys[key.ID()] = k
 	}
 
-	// Check to ensure we have at least on signing key
+	// Check to ensure we have at least one signing key
 	if len(privKeys) == 0 {
 		return ErrNoKeys{keyIDs: ids}
 	}
@@ -68,7 +68,7 @@ func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
 	if len(signatures) < 1 {
 		return ErrInsufficientSignatures{
 			Name: fmt.Sprintf(
-				"Cryptoservice failed to produce any signatures for keys with IDs: %v",
+				"cryptoservice failed to produce any signatures for keys with IDs: %v",
 				ids),
 		}
 	}
diff --git a/tuf/signed/sign_test.go b/tuf/signed/sign_test.go
index 6e404956aa..6ceb3e5232 100644
--- a/tuf/signed/sign_test.go
+++ b/tuf/signed/sign_test.go
@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"io"
 	"testing"
 
@@ -55,7 +54,7 @@ func (mts *FailingCryptoService) GetPrivateKey(keyID string) (data.PrivateKey, s
 	if mts.testKey != nil {
 		return mts.testKey, "testRole", nil
 	}
-	return nil, "", errors.New("Key not found " + keyID)
+	return nil, "", trustmanager.ErrKeyNotFound{KeyID: keyID}
 }
 
 func (mts *FailingCryptoService) RemoveKey(keyID string) error {

From b0354762d15d02b4c6dae132b1bf20e9bbce7785 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Mon, 9 Nov 2015 23:27:01 -0800
Subject: [PATCH 59/85] make touch to sign message configurable Signed-off-by:
 David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 trustmanager/yubikeystore.go | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index c657b99823..bf19901d1a 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -56,6 +56,25 @@ func SetYubikeyKeyMode(keyMode int) error {
 	return nil
 }
 
+// SetTouchToSignUI - allows configurable UX for notifying a user that they
+// need to touch the yubikey to sign. The callback may be used to provide a
+// mechanism for updating a GUI (such as removing a modal) after the touch
+// has been made
+func SetTouchToSignUI(notifier func(), callback func()) {
+	touchToSignUI = notifier
+	if callback != nil {
+		touchDoneCallback = callback
+	}
+}
+
+var touchToSignUI = func() {
+	fmt.Println("Please touch the attached Yubikey to perform signing.")
+}
+
+var touchDoneCallback = func() {
+	// noop
+}
+
 var pkcs11Lib string
 
 func init() {
@@ -324,7 +343,8 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	// Get the SHA256 of the payload
 	digest := sha256.Sum256(payload)
 
-	fmt.Println("Please touch the attached Yubikey to perform signing.")
+	touchToSignUI()
+	defer touchDoneCallback()
 	sig, err = ctx.Sign(session, digest[:])
 	if err != nil {
 		logrus.Debugf("Error while signing: %s", err)

From 8ffbf116cc38b5097ec7bf047500e7955fba87e5 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 12:59:29 -0800
Subject: [PATCH 60/85] only tell user to touch when mode is enabled
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 trustmanager/yubikeystore.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index bf19901d1a..6945944c8c 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -343,8 +343,10 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	// Get the SHA256 of the payload
 	digest := sha256.Sum256(payload)
 
-	touchToSignUI()
-	defer touchDoneCallback()
+	if (yubikeyKeymode & KeymodeTouch) > 0 {
+		touchToSignUI()
+		defer touchDoneCallback()
+	}
 	sig, err = ctx.Sign(session, digest[:])
 	if err != nil {
 		logrus.Debugf("Error while signing: %s", err)

From 6acc130e17f56dc0de06d9a2dd81e914b03e21ac Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 12:55:18 -0800
Subject: [PATCH 61/85] list shows where the key is stored Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go              | 97 +++++++++++++++++++++++++--------
 cmd/notary/keys_nonpkcs11.go    | 16 +-----
 cmd/notary/keys_pkcs11.go       | 32 ++---------
 signer/keydbstore/keydbstore.go |  5 ++
 trustmanager/keyfilestore.go    | 13 +++++
 trustmanager/keystore.go        |  1 +
 trustmanager/yubikeystore.go    |  6 ++
 7 files changed, 105 insertions(+), 65 deletions(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 6104edd987..218b68e67a 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -7,7 +7,11 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
+	"github.com/docker/notary/cryptoservice"
+	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/trustmanager"
 
 	"github.com/docker/notary/tuf/data"
 	"github.com/spf13/cobra"
@@ -93,16 +97,20 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, true)
+	stores := getKeyStores(cmd, trustDir, retriever, true)
 
-	// Get a map of all the keys/roles
-	keysMap := cs.ListAllKeys()
+	keys := make(map[trustmanager.KeyStore]map[string]string)
+	for _, store := range stores {
+		keys[store] = store.ListKeys()
+	}
 
 	cmd.Println("")
 	cmd.Println("# Root keys: ")
-	for k, v := range keysMap {
-		if v == "root" {
-			cmd.Println(k)
+	for store, keysMap := range keys {
+		for k, v := range keysMap {
+			if v == "root" {
+				cmd.Println(k, " - ", store.Name())
+			}
 		}
 	}
 
@@ -110,17 +118,20 @@ func keysList(cmd *cobra.Command, args []string) {
 	cmd.Println("# Signing keys: ")
 
 	// Get a list of all the keys
-	var sortedKeys []string
-	for k := range keysMap {
-		sortedKeys = append(sortedKeys, k)
-	}
-	// Sort the list of all the keys
-	sort.Strings(sortedKeys)
+	for store, keysMap := range keys {
+		var sortedKeys []string
+		for k := range keysMap {
+			sortedKeys = append(sortedKeys, k)
+		}
 
-	// Print a sorted list of the key/role
-	for _, k := range sortedKeys {
-		if keysMap[k] != "root" {
-			printKey(cmd, k, keysMap[k])
+		// Sort the list of all the keys
+		sort.Strings(sortedKeys)
+
+		// Print a sorted list of the key/role
+		for _, k := range sortedKeys {
+			if keysMap[k] != "root" {
+				printKey(cmd, k, keysMap[k], store.Name())
+			}
 		}
 	}
 }
@@ -143,7 +154,10 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, true)
+	cs := cryptoservice.NewCryptoService(
+		"",
+		getKeyStores(cmd, trustDir, retriever, true)...,
+	)
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
 	if err != nil {
@@ -164,7 +178,10 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, false)
+	cs := cryptoservice.NewCryptoService(
+		"",
+		getKeyStores(cmd, trustDir, retriever, true)...,
+	)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -204,7 +221,10 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, false)
+	cs := cryptoservice.NewCryptoService(
+		"",
+		getKeyStores(cmd, trustDir, retriever, true)...,
+	)
 
 	exportFile, err := os.Create(exportFilename)
 	if err != nil {
@@ -236,7 +256,10 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, false)
+	cs := cryptoservice.NewCryptoService(
+		"",
+		getKeyStores(cmd, trustDir, retriever, true)...,
+	)
 
 	zipReader, err := zip.OpenReader(importFilename)
 	if err != nil {
@@ -262,7 +285,10 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	cs := getCryptoService(cmd, trustDir, retriever, true)
+	cs := cryptoservice.NewCryptoService(
+		"",
+		getKeyStores(cmd, trustDir, retriever, true)...,
+	)
 
 	importFile, err := os.Open(importFilename)
 	if err != nil {
@@ -277,10 +303,10 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 	}
 }
 
-func printKey(cmd *cobra.Command, keyPath, alias string) {
+func printKey(cmd *cobra.Command, keyPath, alias, loc string) {
 	keyID := filepath.Base(keyPath)
 	gun := filepath.Dir(keyPath)
-	cmd.Printf("%s - %s - %s\n", gun, alias, keyID)
+	cmd.Printf("%s - %s - %s - %s\n", gun, alias, keyID, loc)
 }
 
 func keysRotate(cmd *cobra.Command, args []string) {
@@ -299,3 +325,28 @@ func keysRotate(cmd *cobra.Command, args []string) {
 		fatalf(err.Error())
 	}
 }
+
+func getKeyStores(cmd *cobra.Command, directory string,
+	ret passphrase.Retriever, withHardware bool) []trustmanager.KeyStore {
+
+	keysPath := filepath.Join(directory, notary.PrivDir)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
+	if err != nil {
+		fatalf("Failed to create private key store in directory: %s", keysPath)
+	}
+
+	ks := []trustmanager.KeyStore{fileKeyStore}
+
+	if withHardware {
+		yubiStore, err := getYubiKeyStore(fileKeyStore, ret)
+		if err != nil {
+			cmd.Println("No YubiKey detected - using local filesystem only.")
+		} else {
+			// Note that the order is important, since we want to prioritize
+			// the yubikey store
+			ks = []trustmanager.KeyStore{yubiStore, fileKeyStore}
+		}
+	}
+
+	return ks
+}
diff --git a/cmd/notary/keys_nonpkcs11.go b/cmd/notary/keys_nonpkcs11.go
index 31179d02e6..543cf3b2d5 100644
--- a/cmd/notary/keys_nonpkcs11.go
+++ b/cmd/notary/keys_nonpkcs11.go
@@ -3,22 +3,10 @@
 package main
 
 import (
-	"path/filepath"
-
-	"github.com/docker/notary"
-	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
-	"github.com/spf13/cobra"
 )
 
-func getCryptoService(cmd *cobra.Command, directory string,
-	ret passphrase.Retriever, _ bool) *cryptoservice.CryptoService {
-
-	keysPath := filepath.Join(directory, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
-	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
-	}
-	return cryptoservice.NewCryptoService("", fileKeyStore)
+func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
+	return nil, errors.New("Not built with hardware support")
 }
diff --git a/cmd/notary/keys_pkcs11.go b/cmd/notary/keys_pkcs11.go
index e1df821d12..438d92df53 100644
--- a/cmd/notary/keys_pkcs11.go
+++ b/cmd/notary/keys_pkcs11.go
@@ -3,38 +3,14 @@
 package main
 
 import (
-	"path/filepath"
-
-	"github.com/docker/notary"
-	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
-	"github.com/spf13/cobra"
 )
 
-// Build a CryptoService, optionally including a hardware keystore.  Returns
-// the CryptoService and whether or not a hardware keystore was included.
-func getCryptoService(cmd *cobra.Command, directory string,
-	ret passphrase.Retriever, withHardware bool) *cryptoservice.CryptoService {
-
-	keysPath := filepath.Join(directory, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
+func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
+	yubiStore, err := trustmanager.NewYubiKeyStore(fileKeyStore, ret)
 	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
+		return nil, err
 	}
-
-	ks := []trustmanager.KeyStore{fileKeyStore}
-
-	if withHardware {
-		yubiStore, err := trustmanager.NewYubiKeyStore(fileKeyStore, ret)
-		if err != nil {
-			cmd.Println("No YubiKey detected - using local filesystem only.")
-		} else {
-			// Note that the order is important, since we want to prioritize
-			// the yubikey store
-			ks = []trustmanager.KeyStore{yubiStore, fileKeyStore}
-		}
-	}
-
-	return cryptoservice.NewCryptoService("", ks...)
+	return yubiStore, nil
 }
diff --git a/signer/keydbstore/keydbstore.go b/signer/keydbstore/keydbstore.go
index c3e89a190c..e6b989351e 100644
--- a/signer/keydbstore/keydbstore.go
+++ b/signer/keydbstore/keydbstore.go
@@ -58,6 +58,11 @@ func NewKeyDBStore(passphraseRetriever passphrase.Retriever, defaultPassAlias, d
 		cachedKeys:       cachedKeys}, nil
 }
 
+// Name returns a user friendly name for the storage location
+func (s KeyDBStore) Name() string {
+	return "database"
+}
+
 // AddKey stores the contents of a private key. Both name and alias are ignored,
 // we always use Key IDs as name, and don't support aliases
 func (s *KeyDBStore) AddKey(name, alias string, privKey data.PrivateKey) error {
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index 18b8969b00..d734473e7c 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -1,6 +1,7 @@
 package trustmanager
 
 import (
+	"fmt"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -44,6 +45,12 @@ func NewKeyFileStore(baseDir string, passphraseRetriever passphrase.Retriever) (
 		cachedKeys: cachedKeys}, nil
 }
 
+// Name returns a user friendly name for the location this store
+// keeps its data
+func (s KeyFileStore) Name() string {
+	return fmt.Sprintf("file (%s)", s.SimpleFileStore.BaseDir())
+}
+
 // AddKey stores the contents of a PEM-encoded private key as a PEM block
 func (s *KeyFileStore) AddKey(name, alias string, privKey data.PrivateKey) error {
 	s.Lock()
@@ -96,6 +103,12 @@ func NewKeyMemoryStore(passphraseRetriever passphrase.Retriever) *KeyMemoryStore
 		cachedKeys: cachedKeys}
 }
 
+// Name returns a user friendly name for the location this store
+// keeps its data
+func (s KeyMemoryStore) Name() string {
+	return "memory"
+}
+
 // AddKey stores the contents of a PEM-encoded private key as a PEM block
 func (s *KeyMemoryStore) AddKey(name, alias string, privKey data.PrivateKey) error {
 	s.Lock()
diff --git a/trustmanager/keystore.go b/trustmanager/keystore.go
index 4a06d9962e..88a0e3d774 100644
--- a/trustmanager/keystore.go
+++ b/trustmanager/keystore.go
@@ -46,6 +46,7 @@ type KeyStore interface {
 	RemoveKey(name string) error
 	ExportKey(name string) ([]byte, error)
 	ImportKey(pemBytes []byte, alias string) error
+	Name() string
 }
 
 type cachedKey struct {
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index 6945944c8c..0a1f7fbd69 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -580,6 +580,12 @@ func NewYubiKeyStore(backupStore KeyStore, passphraseRetriever passphrase.Retrie
 	return s, nil
 }
 
+// Name returns a user friendly name for the location this store
+// keeps its data
+func (s YubiKeyStore) Name() string {
+	return "yubikey"
+}
+
 func (s *YubiKeyStore) ListKeys() map[string]string {
 	if len(s.keys) > 0 {
 		return buildKeyMap(s.keys)

From a21287c0d15c6d9fa7a2f88275a5a903b73390d4 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 14:39:33 -0800
Subject: [PATCH 62/85] taking out message when yubikey not found
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 218b68e67a..ba8f578a76 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -339,9 +339,7 @@ func getKeyStores(cmd *cobra.Command, directory string,
 
 	if withHardware {
 		yubiStore, err := getYubiKeyStore(fileKeyStore, ret)
-		if err != nil {
-			cmd.Println("No YubiKey detected - using local filesystem only.")
-		} else {
+		if err == nil && yubiStore != nil {
 			// Note that the order is important, since we want to prioritize
 			// the yubikey store
 			ks = []trustmanager.KeyStore{yubiStore, fileKeyStore}

From 5c064e204b66d0e9a8172d3c5070f457c5b3ab21 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 15:49:41 -0800
Subject: [PATCH 63/85] fixing lint/vet Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 signer/keydbstore/keydbstore.go | 2 +-
 trustmanager/keyfilestore.go    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/signer/keydbstore/keydbstore.go b/signer/keydbstore/keydbstore.go
index e6b989351e..2f9813932f 100644
--- a/signer/keydbstore/keydbstore.go
+++ b/signer/keydbstore/keydbstore.go
@@ -59,7 +59,7 @@ func NewKeyDBStore(passphraseRetriever passphrase.Retriever, defaultPassAlias, d
 }
 
 // Name returns a user friendly name for the storage location
-func (s KeyDBStore) Name() string {
+func (s *KeyDBStore) Name() string {
 	return "database"
 }
 
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index d734473e7c..b8148c58ca 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -47,7 +47,7 @@ func NewKeyFileStore(baseDir string, passphraseRetriever passphrase.Retriever) (
 
 // Name returns a user friendly name for the location this store
 // keeps its data
-func (s KeyFileStore) Name() string {
+func (s *KeyFileStore) Name() string {
 	return fmt.Sprintf("file (%s)", s.SimpleFileStore.BaseDir())
 }
 
@@ -105,7 +105,7 @@ func NewKeyMemoryStore(passphraseRetriever passphrase.Retriever) *KeyMemoryStore
 
 // Name returns a user friendly name for the location this store
 // keeps its data
-func (s KeyMemoryStore) Name() string {
+func (s *KeyMemoryStore) Name() string {
 	return "memory"
 }
 

From ee270b6a2bada1931db54c9435c6d13a7f54e854 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Tue, 10 Nov 2015 16:39:01 -0800
Subject: [PATCH 64/85] fixing integrations tests for new list keys layout
 Signed-off-by: David Lawrence <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/integration_test.go    | 26 ++++++++++++++------------
 cmd/notary/keys.go                |  2 +-
 cmd/notary/keys_nonpkcs11.go      |  2 ++
 cmd/notary/keys_pkcs11.go         |  6 +-----
 cryptoservice/import_export.go    | 11 ++++++++++-
 trustmanager/x509utils.go         |  8 ++++----
 trustmanager/yubikeystore.go      |  7 +++++--
 trustmanager/yubikeystore_test.go |  2 +-
 8 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
index ad3e1c509c..0cf30fee4b 100644
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/docker/notary/server"
 	"github.com/docker/notary/server/storage"
 	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/tuf/data"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
@@ -50,10 +51,7 @@ func setupServer() *httptest.Server {
 	ctx := context.WithValue(
 		context.Background(), "metaStore", storage.NewMemStorage())
 
-	// Do not pass one of the const KeyAlgorithms here as the value! Passing a
-	// string is in itself good test that we are handling it correctly as we
-	// will be receiving a string from the configuration.
-	ctx = context.WithValue(ctx, "keyAlgorithm", "ecdsa")
+	ctx = context.WithValue(ctx, "keyAlgorithm", data.ECDSAKey)
 
 	// Eat the logs instead of spewing them out
 	var b bytes.Buffer
@@ -181,19 +179,24 @@ func GetKeys(t *testing.T, tempDir string) ([]string, []string) {
 func assertNumKeys(t *testing.T, tempDir string, numRoot, numSigning int,
 	rootOnDisk bool) ([]string, []string) {
 
+	uniqueKeys := make(map[string]struct{})
 	root, signing := GetKeys(t, tempDir)
-	assert.Len(t, root, numRoot)
 	assert.Len(t, signing, numSigning)
-	for _, rootKeyID := range root {
+	for i, rootKeyLine := range root {
+		keyID := strings.Split(rootKeyLine, "-")[0]
+		keyID = strings.TrimSpace(keyID)
+		root[i] = keyID
+		uniqueKeys[keyID] = struct{}{}
 		_, err := os.Stat(filepath.Join(
-			tempDir, "private", "root_keys", rootKeyID+"_root.key"))
+			tempDir, "private", "root_keys", keyID+"_root.key"))
 		// os.IsExist checks to see if the error is because a file already
 		// exist, and hence doesn't actually the right funciton to use here
 		assert.Equal(t, rootOnDisk, !os.IsNotExist(err))
 
 		// this function is declared is in the build-tagged setup files
-		verifyRootKeyOnHardware(t, rootKeyID)
+		verifyRootKeyOnHardware(t, keyID)
 	}
+	assert.Len(t, uniqueKeys, numRoot)
 	return root, signing
 }
 
@@ -245,7 +248,7 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	assertNumKeys(t, tempDir, 0, 0, true)
 
 	// generate root key produces a single root key and no other keys
-	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
+	_, err = runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
 	assert.NoError(t, err)
 	assertNumKeys(t, tempDir, 1, 0, true)
 
@@ -345,7 +348,7 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 
 	_, err = runCommand(t, dirs[1], "key", "import", zipfile)
 	assert.NoError(t, err)
-	assertNumKeys(t, dirs[1], 1, 4, true) // all keys should be there
+	assertNumKeys(t, dirs[1], 1, 4, !rootOnHardware()) // all keys should be there
 
 	// can list and publish to both repos using imported keys
 	for _, gun := range []string{"gun1", "gun2"} {
@@ -383,7 +386,7 @@ func exportRoot(t *testing.T, exportTo string) string {
 	defer os.RemoveAll(tempDir)
 
 	// generate root key produces a single root key and no other keys
-	_, err = runCommand(t, tempDir, "key", "generate", "ecdsa")
+	_, err = runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
 	assert.NoError(t, err)
 	oldRoot, _ := assertNumKeys(t, tempDir, 1, 0, true)
 
@@ -505,7 +508,6 @@ func TestClientCertInteraction(t *testing.T) {
 	_, err = runCommand(t, tempDir, "cert", "remove", certID, "-y", "-g", "")
 	assert.NoError(t, err)
 	assertNumCerts(t, tempDir, 0)
-
 }
 
 func TestMain(m *testing.M) {
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index ba8f578a76..985d33e427 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -109,7 +109,7 @@ func keysList(cmd *cobra.Command, args []string) {
 	for store, keysMap := range keys {
 		for k, v := range keysMap {
 			if v == "root" {
-				cmd.Println(k, " - ", store.Name())
+				cmd.Println(k, "-", store.Name())
 			}
 		}
 	}
diff --git a/cmd/notary/keys_nonpkcs11.go b/cmd/notary/keys_nonpkcs11.go
index 543cf3b2d5..bcb75b0a06 100644
--- a/cmd/notary/keys_nonpkcs11.go
+++ b/cmd/notary/keys_nonpkcs11.go
@@ -3,6 +3,8 @@
 package main
 
 import (
+	"errors"
+
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 )
diff --git a/cmd/notary/keys_pkcs11.go b/cmd/notary/keys_pkcs11.go
index 438d92df53..87af9dad65 100644
--- a/cmd/notary/keys_pkcs11.go
+++ b/cmd/notary/keys_pkcs11.go
@@ -8,9 +8,5 @@ import (
 )
 
 func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
-	yubiStore, err := trustmanager.NewYubiKeyStore(fileKeyStore, ret)
-	if err != nil {
-		return nil, err
-	}
-	return yubiStore, nil
+	return trustmanager.NewYubiKeyStore(fileKeyStore, ret)
 }
diff --git a/cryptoservice/import_export.go b/cryptoservice/import_export.go
index 7ee3ded5ad..66405b22e3 100644
--- a/cryptoservice/import_export.go
+++ b/cryptoservice/import_export.go
@@ -197,11 +197,20 @@ func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader) error {
 		if keyName[len(keyName)-5:] == "_root" {
 			keyName = "root"
 		}
+		// try to import the key to all key stores. As long as one of them
+		// succeeds, consider it a success
+		var tmpErr error
 		for _, ks := range cs.keyStores {
 			if err := ks.ImportKey(pemBytes, keyName); err != nil {
-				return err
+				tmpErr = err
+			} else {
+				tmpErr = nil
+				break
 			}
 		}
+		if tmpErr != nil {
+			return tmpErr
+		}
 	}
 
 	return nil
diff --git a/trustmanager/x509utils.go b/trustmanager/x509utils.go
index e462671a04..51877ae45b 100644
--- a/trustmanager/x509utils.go
+++ b/trustmanager/x509utils.go
@@ -398,12 +398,12 @@ func ED25519ToPrivateKey(privKeyBytes []byte) (data.PrivateKey, error) {
 }
 
 func blockType(k data.PrivateKey) (string, error) {
-	switch k.(type) {
-	case *data.RSAPrivateKey:
+	switch k.Algorithm() {
+	case data.RSAKey, data.RSAx509Key:
 		return "RSA PRIVATE KEY", nil
-	case *data.ECDSAPrivateKey:
+	case data.ECDSAKey, data.ECDSAx509Key:
 		return "EC PRIVATE KEY", nil
-	case *data.ED25519PrivateKey:
+	case data.ED25519Key:
 		return "ED25519 PRIVATE KEY", nil
 	default:
 		return "", fmt.Errorf("algorithm %s not supported", k.Algorithm())
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index 0a1f7fbd69..52f106a718 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -707,13 +707,16 @@ func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
 }
 
 // ImportKey imports a root key into a Yubikey
-func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyID string) error {
-	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyID)
+func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
+	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyPath)
 	privKey, _, err := GetPasswdDecryptBytes(
 		s.passRetriever, pemBytes, "", "imported root")
 	if err != nil {
 		return err
 	}
+	if keyPath != data.CanonicalRootRole {
+		return fmt.Errorf("yubikey only supports storing root keys")
+	}
 	return s.addKey(privKey.ID(), "root", privKey, false)
 }
 
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikeystore_test.go
index b769404cc4..6bbd9b8bc3 100644
--- a/trustmanager/yubikeystore_test.go
+++ b/trustmanager/yubikeystore_test.go
@@ -129,7 +129,7 @@ func TestImportKey(t *testing.T) {
 	pemBytes, err := EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
-	err = store.ImportKey(pemBytes, privKey.ID())
+	err = store.ImportKey(pemBytes, "root")
 	assert.NoError(t, err)
 
 	// key is not in backup store

From 5b7480f599f97817f015475e770ad9e8241cf6c8 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo.monica@gmail.com>
Date: Mon, 9 Nov 2015 19:42:50 -0800
Subject: [PATCH 65/85] Adding default to notary key generate and configurable
 trust dir from config

Signed-off-by: Diogo Monica <diogo.monica@gmail.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo.monica@gmail.com> (github: endophage)
---
 .DS_Store                      | Bin 0 -> 6148 bytes
 cmd/notary/cert.go             |   4 +--
 cmd/notary/integration_test.go |  21 ++++++++++++++++
 cmd/notary/keys.go             |  39 ++++++++++++++++-------------
 cmd/notary/main.go             |  44 ++++++++++++++++++++-------------
 cmd/notary/tuf.go              |  35 ++++++++++++++------------
 6 files changed, 91 insertions(+), 52 deletions(-)
 create mode 100644 .DS_Store

diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..c5a1abbe51c28373d2ba531833091a7a8c9201cb
GIT binary patch
literal 6148
zcmeHK%}T>S5Z-O8rg|`fqTX`z(nCwd9u2jgyc8<!L8T@%*oCkuO=^)+$UFG|9QrW6
zfbZeV?zXg4Pl8C93A5kq>`a#VHtc2@W4t=(lo+!aV-_f4CJ)Uwg5#(Qk})1cj_-(j
zei-@C`}BJY(d77#4B*;jna>21{&05vLJ=p$;s?)Ub1SQBR(>6y&HPoP8x0$Ymki>n
z*S}Cb(FuHG*S(}WvCpF@oZ6n>6v41<Z=Xam@q`TeGpUy?Av@8q8VzJ8ZreNcesBxX
zbx#IO5er|0BDu5j__Xca(Wq1`IHgi?TyRE}3fPC`qw(0X_7BR(XDvCpe|UU)etCV<
zd~^6Tm24TDz&jYG^xH;XhLOAh&m?*hMMw+~1H`}*GGMkkYhwv(qmqaLV&HcS;Qru%
zBDw}sjcV(F27e!MJcoz^Hr^!=9fPjHR3nUlaGeUMQ@OcfaGef*$Hch?Q;j;EaWyl%
z$IQ&l4TY=O!SASW#$Aon5(C7*JOf$XwekEv{rUbspF}-kfEZXR26(R4s8yjPbG9xN
whi9z=dJT$#ajC{>3K;4rhFCm`_du0^-$4V=HJEAy4+#ATC>p3C2L6<RFY!rQ%K!iX

literal 0
HcmV?d00001

diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index 9ed6937724..e941dd4249 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -53,9 +53,9 @@ func certRemove(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify the cert ID or the GUN of the certificates to remove")
 	}
-
 	parseConfig()
 
+	trustDir := mainViper.GetString("trustDir")
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
@@ -122,9 +122,9 @@ func certList(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		os.Exit(1)
 	}
-
 	parseConfig()
 
+	trustDir := mainViper.GetString("trustDir")
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
index 0cf30fee4b..f2c0c09e27 100644
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -510,6 +510,27 @@ func TestClientCertInteraction(t *testing.T) {
 	assertNumCerts(t, tempDir, 0)
 }
 
+// Tests default root key generation
+func TestDefaultRootKeyGeneration(t *testing.T) {
+	// -- setup --
+	cleanup := setUp(t)
+	defer cleanup()
+
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	defer os.RemoveAll(tempDir)
+
+	// -- tests --
+
+	// starts out with no keys
+	assertNumKeys(t, tempDir, 0, 0, true)
+
+	// generate root key with no algorithm produces a single ECDSA root key and no other keys
+	_, err = runCommand(t, tempDir, "key", "generate")
+	assert.NoError(t, err)
+	assertNumKeys(t, tempDir, 1, 0, true)
+}
+
 func TestMain(m *testing.M) {
 	if testing.Short() {
 		// skip
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 985d33e427..b8e179c180 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -97,7 +97,7 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	stores := getKeyStores(cmd, trustDir, retriever, true)
+	stores := getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)
 
 	keys := make(map[trustmanager.KeyStore]map[string]string)
 	for _, store := range stores {
@@ -137,15 +137,19 @@ func keysList(cmd *cobra.Command, args []string) {
 }
 
 func keysGenerateRootKey(cmd *cobra.Command, args []string) {
-	if len(args) < 1 {
-		cmd.Usage()
-		fatalf("Must specify an Algorithm (RSA, ECDSA)")
+	parseConfig()
+
+	// If no param is given to generate, generates an ecdsa key by default
+	algorithm := data.ECDSAKey
+
+	// If we were provided an argument lets attempt to use it as an algorithm
+	if len(args) > 0 {
+		algorithm = args[0]
 	}
 
-	algorithm := args[0]
 	allowedCiphers := map[string]bool{
-		"rsa":   true,
-		"ecdsa": true,
+		data.ECDSAKey: true,
+		data.RSAKey:   true,
 	}
 
 	if !allowedCiphers[strings.ToLower(algorithm)] {
@@ -156,7 +160,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, trustDir, retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
 	)
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
@@ -174,13 +178,12 @@ func keysExport(cmd *cobra.Command, args []string) {
 		fatalf("Must specify output filename for export")
 	}
 
-	exportFilename := args[0]
-
 	parseConfig()
+	exportFilename := args[0]
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, trustDir, retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)
@@ -212,6 +215,8 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 		fatalf("Must specify key ID and output filename for export")
 	}
 
+	parseConfig()
+
 	keyID := args[0]
 	exportFilename := args[1]
 
@@ -223,7 +228,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, trustDir, retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)
@@ -258,7 +263,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, trustDir, retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
 	)
 
 	zipReader, err := zip.OpenReader(importFilename)
@@ -281,15 +286,15 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 		fatalf("Must specify input filename for import")
 	}
 
-	importFilename := args[0]
-
 	parseConfig()
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, trustDir, retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
 	)
 
+	importFilename := args[0]
+
 	importFile, err := os.Open(importFilename)
 	if err != nil {
 		fatalf("Opening file for import: %v", err)
@@ -317,7 +322,7 @@ func keysRotate(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	gun := args[0]
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, remoteTrustServer, nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, remoteTrustServer, nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 78791f80b0..c01fb0cae5 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -43,21 +43,17 @@ func parseConfig() {
 		logrus.SetOutput(os.Stderr)
 	}
 
-	if trustDir == "" {
-		// Get home directory for current user
-		homeDir, err := homedir.Dir()
-		if err != nil {
-			fatalf("Cannot get current user home directory: %v", err)
-		}
-		if homeDir == "" {
-			fatalf("Cannot get current user home directory")
-		}
-		trustDir = filepath.Join(homeDir, filepath.Dir(configDir))
-
-		logrus.Debugf("no trust directory provided, using default: %s", trustDir)
-	} else {
-		logrus.Debugf("trust directory provided: %s", trustDir)
+	// Get home directory for current user
+	homeDir, err := homedir.Dir()
+	if err != nil {
+		fatalf("Cannot get current user home directory: %v", err)
 	}
+	if homeDir == "" {
+		fatalf("Cannot get current user home directory")
+	}
+
+	// By default our trust directory (where keys are stored) is in ~/.notary/
+	mainViper.SetDefault("trustDir", filepath.Join(homeDir, filepath.Dir(configDir)))
 
 	// If there was a commandline configFile set, we parse that.
 	// If there wasn't we attempt to find it on the default location ~/.notary/config
@@ -66,7 +62,7 @@ func parseConfig() {
 		configFileName = strings.TrimSuffix(filepath.Base(configFile), filepath.Ext(configFile))
 		configPath = filepath.Dir(configFile)
 	} else {
-		configPath = trustDir
+		configPath = filepath.Join(homeDir, filepath.Dir(configDir))
 	}
 
 	// Setup the configuration details into viper
@@ -75,7 +71,7 @@ func parseConfig() {
 	mainViper.AddConfigPath(configPath)
 
 	// Find and read the config file
-	err := mainViper.ReadInConfig()
+	err = mainViper.ReadInConfig()
 	if err != nil {
 		logrus.Debugf("configuration file not found, using defaults")
 		// Ignore if the configuration file doesn't exist, we can use the defaults
@@ -83,6 +79,20 @@ func parseConfig() {
 			fatalf("Fatal error config file: %v", err)
 		}
 	}
+
+	// At this point we either have the default value or the one set by the config.
+	// Either way, the command-line flag has precedence and overwrives the value
+	if trustDir != "" {
+		mainViper.Set("trustDir", trustDir)
+	}
+
+	// Expands all the possible ~/ that have been given, either through -d or config
+	// If there is no error, user it, if not, attempt to use whatever the user gave us
+	expandedTrustDir, err := homedir.Expand(mainViper.GetString("trustDir"))
+	if err == nil {
+		mainViper.Set("trustDir", expandedTrustDir)
+	}
+	logrus.Debugf("using the following trust directory: %s", mainViper.GetString("trustDir"))
 }
 
 func setupCommand(notaryCmd *cobra.Command) {
@@ -97,7 +107,7 @@ func setupCommand(notaryCmd *cobra.Command) {
 
 	notaryCmd.AddCommand(versionCmd)
 
-	notaryCmd.PersistentFlags().StringVarP(&trustDir, "trustdir", "d", "", "Directory where the trust data is persisted to")
+	notaryCmd.PersistentFlags().StringVarP(&trustDir, "trustDir", "d", "", "Directory where the trust data is persisted to")
 	notaryCmd.PersistentFlags().StringVarP(&configFile, "configFile", "c", "", "Path to the configuration file to use")
 	notaryCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "Verbose output")
 	notaryCmd.PersistentFlags().StringVarP(&remoteTrustServer, "server", "s", "", "Remote trust server location")
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index 16b6ef57d7..299bb18f77 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -86,15 +86,15 @@ func tufAdd(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify a GUN, target, and path to target data")
 	}
+	parseConfig()
 
 	gun := args[0]
 	targetName := args[1]
 	targetPath := args[2]
 
-	parseConfig()
 	// no online operations are performed by add so the transport argument
 	// should be nil
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -118,10 +118,10 @@ func tufInit(cmd *cobra.Command, args []string) {
 		fatalf("Must specify a GUN")
 	}
 
-	gun := args[0]
 	parseConfig()
+	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -154,10 +154,10 @@ func tufList(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify a GUN")
 	}
-	gun := args[0]
 	parseConfig()
+	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -179,11 +179,12 @@ func tufLookup(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify a GUN and target")
 	}
-	gun := args[0]
-	targetName := args[1]
 	parseConfig()
 
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	gun := args[0]
+	targetName := args[1]
+
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -202,10 +203,10 @@ func tufStatus(cmd *cobra.Command, args []string) {
 		fatalf("Must specify a GUN")
 	}
 
-	gun := args[0]
 	parseConfig()
+	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -234,12 +235,12 @@ func tufPublish(cmd *cobra.Command, args []string) {
 		fatalf("Must specify a GUN")
 	}
 
-	gun := args[0]
 	parseConfig()
+	gun := args[0]
 
 	cmd.Println("Pushing changes to", gun)
 
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -255,13 +256,14 @@ func tufRemove(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify a GUN and target")
 	}
+	parseConfig()
+
 	gun := args[0]
 	targetName := args[1]
-	parseConfig()
 
 	// no online operation are performed by remove so the transport argument
 	// should be nil.
-	repo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), nil, retriever)
+	repo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -278,6 +280,7 @@ func verify(cmd *cobra.Command, args []string) {
 		cmd.Usage()
 		fatalf("Must specify a GUN and target")
 	}
+
 	parseConfig()
 
 	// Reads all of the data on STDIN
@@ -288,7 +291,7 @@ func verify(cmd *cobra.Command, args []string) {
 
 	gun := args[0]
 	targetName := args[1]
-	nRepo, err := notaryclient.NewNotaryRepository(trustDir, gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}

From 0344dfc03882f3a6a7a9ad224300745a1406543a Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Tue, 10 Nov 2015 22:48:30 -0800
Subject: [PATCH 66/85] Making tests pass

Signed-off-by: Diogo Monica <diogo@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 cmd/notary/cert.go             |  4 +--
 cmd/notary/integration_test.go | 58 +++++++++++++++++-------------
 cmd/notary/keys.go             | 19 ++++++----
 cmd/notary/main.go             | 19 +++++-----
 cmd/notary/tuf.go              | 16 ++++-----
 trustmanager/yubikeystore.go   | 64 ++++++++++++++++++++--------------
 6 files changed, 103 insertions(+), 77 deletions(-)

diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index e941dd4249..95ae44e03a 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -55,7 +55,7 @@ func certRemove(cmd *cobra.Command, args []string) {
 	}
 	parseConfig()
 
-	trustDir := mainViper.GetString("trustDir")
+	trustDir := mainViper.GetString("trust_dir")
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
@@ -124,7 +124,7 @@ func certList(cmd *cobra.Command, args []string) {
 	}
 	parseConfig()
 
-	trustDir := mainViper.GetString("trustDir")
+	trustDir := mainViper.GetString("trust_dir")
 	keysPath := filepath.Join(trustDir, notary.PrivDir)
 	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
 	if err != nil {
diff --git a/cmd/notary/integration_test.go b/cmd/notary/integration_test.go
index f2c0c09e27..ce3166c561 100644
--- a/cmd/notary/integration_test.go
+++ b/cmd/notary/integration_test.go
@@ -25,23 +25,31 @@ import (
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
-var cmd = &cobra.Command{}
 var testPassphrase = "passphrase"
 
 // run a command and return the output as a string
 func runCommand(t *testing.T, tempDir string, args ...string) (string, error) {
-	b := new(bytes.Buffer)
-	cmd.SetArgs(append([]string{"-c", "/tmp/ignore.json", "-d", tempDir}, args...))
-	cmd.SetOutput(b)
-	t.Logf("Running `notary %s`", strings.Join(args, " "))
+	// Using a new viper and Command so we don't have state between command invocations
+	mainViper = viper.New()
+	cmd := &cobra.Command{}
+	setupCommand(cmd)
 
+	b := new(bytes.Buffer)
+
+	// Create an empty config file so we don't load the default on ~/.notary/config.json
+	configFile := filepath.Join(tempDir, "config.json")
+
+	cmd.SetArgs(append([]string{"-c", configFile, "-d", tempDir}, args...))
+	cmd.SetOutput(b)
 	retErr := cmd.Execute()
 	output, err := ioutil.ReadAll(b)
 	assert.NoError(t, err)
+
 	return string(output), retErr
 }
 
@@ -71,8 +79,7 @@ func TestClientTufInteraction(t *testing.T) {
 	cleanup := setUp(t)
 	defer cleanup()
 
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	server := setupServer()
@@ -122,7 +129,7 @@ func TestClientTufInteraction(t *testing.T) {
 	assert.True(t, strings.Contains(string(output), target))
 
 	// verify repo - empty file
-	output, err = runCommand(t, tempDir, "verify", "gun", target)
+	output, err = runCommand(t, tempDir, "-s", server.URL, "verify", "gun", target)
 	assert.NoError(t, err)
 
 	// remove target
@@ -224,8 +231,7 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	cleanup := setUp(t)
 	defer cleanup()
 
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	tempfiles := make([]string, 2)
@@ -248,7 +254,7 @@ func TestClientKeyGenerationRotation(t *testing.T) {
 	assertNumKeys(t, tempDir, 0, 0, true)
 
 	// generate root key produces a single root key and no other keys
-	_, err = runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
+	_, err := runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
 	assert.NoError(t, err)
 	assertNumKeys(t, tempDir, 1, 0, true)
 
@@ -305,8 +311,7 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 
 	dirs := make([]string, 3)
 	for i := 0; i < 3; i++ {
-		tempDir, err := ioutil.TempDir("/tmp", "repo")
-		assert.NoError(t, err)
+		tempDir := tempDirWithConfig(t, "{}")
 		defer os.RemoveAll(tempDir)
 		dirs[i] = tempDir
 	}
@@ -381,12 +386,11 @@ func TestClientKeyImportExportRootAndSigning(t *testing.T) {
 // Generate a root key and export the root key only.  Return the key ID
 // exported.
 func exportRoot(t *testing.T, exportTo string) string {
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	// generate root key produces a single root key and no other keys
-	_, err = runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
+	_, err := runCommand(t, tempDir, "key", "generate", data.ECDSAKey)
 	assert.NoError(t, err)
 	oldRoot, _ := assertNumKeys(t, tempDir, 1, 0, true)
 
@@ -410,8 +414,7 @@ func TestClientKeyImportExportRootOnly(t *testing.T) {
 	cleanup := setUp(t)
 	defer cleanup()
 
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	server := setupServer()
@@ -481,15 +484,14 @@ func TestClientCertInteraction(t *testing.T) {
 	cleanup := setUp(t)
 	defer cleanup()
 
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	server := setupServer()
 	defer server.Close()
 
 	// -- tests --
-	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun1")
+	_, err := runCommand(t, tempDir, "-s", server.URL, "init", "gun1")
 	assert.NoError(t, err)
 	_, err = runCommand(t, tempDir, "-s", server.URL, "init", "gun2")
 	assert.NoError(t, err)
@@ -516,8 +518,7 @@ func TestDefaultRootKeyGeneration(t *testing.T) {
 	cleanup := setUp(t)
 	defer cleanup()
 
-	tempDir, err := ioutil.TempDir("/tmp", "repo")
-	assert.NoError(t, err)
+	tempDir := tempDirWithConfig(t, "{}")
 	defer os.RemoveAll(tempDir)
 
 	// -- tests --
@@ -526,16 +527,23 @@ func TestDefaultRootKeyGeneration(t *testing.T) {
 	assertNumKeys(t, tempDir, 0, 0, true)
 
 	// generate root key with no algorithm produces a single ECDSA root key and no other keys
-	_, err = runCommand(t, tempDir, "key", "generate")
+	_, err := runCommand(t, tempDir, "key", "generate")
 	assert.NoError(t, err)
 	assertNumKeys(t, tempDir, 1, 0, true)
 }
 
+func tempDirWithConfig(t *testing.T, config string) string {
+	tempDir, err := ioutil.TempDir("/tmp", "repo")
+	assert.NoError(t, err)
+	err = ioutil.WriteFile(filepath.Join(tempDir, "config.json"), []byte(config), 0644)
+	assert.NoError(t, err)
+	return tempDir
+}
+
 func TestMain(m *testing.M) {
 	if testing.Short() {
 		// skip
 		os.Exit(0)
 	}
-	setupCommand(cmd)
 	os.Exit(m.Run())
 }
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index b8e179c180..8e014c52f5 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -97,7 +97,7 @@ func keysList(cmd *cobra.Command, args []string) {
 
 	parseConfig()
 
-	stores := getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)
+	stores := getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)
 
 	keys := make(map[trustmanager.KeyStore]map[string]string)
 	for _, store := range stores {
@@ -137,6 +137,11 @@ func keysList(cmd *cobra.Command, args []string) {
 }
 
 func keysGenerateRootKey(cmd *cobra.Command, args []string) {
+	if len(args) > 1 {
+		cmd.Usage()
+		fatalf("Please provide only one Algorithm as an argument to generate (rsa, ecdsa)")
+	}
+
 	parseConfig()
 
 	// If no param is given to generate, generates an ecdsa key by default
@@ -160,7 +165,7 @@ func keysGenerateRootKey(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
 	)
 
 	pubKey, err := cs.Create(data.CanonicalRootRole, algorithm)
@@ -183,7 +188,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)
@@ -228,7 +233,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)
@@ -263,7 +268,7 @@ func keysImport(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
 	)
 
 	zipReader, err := zip.OpenReader(importFilename)
@@ -290,7 +295,7 @@ func keysImportRoot(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trustDir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
 	)
 
 	importFilename := args[0]
@@ -322,7 +327,7 @@ func keysRotate(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	gun := args[0]
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, remoteTrustServer, nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, remoteTrustServer, nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index c01fb0cae5..805ef928eb 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -53,7 +53,7 @@ func parseConfig() {
 	}
 
 	// By default our trust directory (where keys are stored) is in ~/.notary/
-	mainViper.SetDefault("trustDir", filepath.Join(homeDir, filepath.Dir(configDir)))
+	mainViper.SetDefault("trust_dir", filepath.Join(homeDir, filepath.Dir(configDir)))
 
 	// If there was a commandline configFile set, we parse that.
 	// If there wasn't we attempt to find it on the default location ~/.notary/config
@@ -73,26 +73,27 @@ func parseConfig() {
 	// Find and read the config file
 	err = mainViper.ReadInConfig()
 	if err != nil {
-		logrus.Debugf("configuration file not found, using defaults")
-		// Ignore if the configuration file doesn't exist, we can use the defaults
-		if !os.IsNotExist(err) {
-			fatalf("Fatal error config file: %v", err)
+		logrus.Debugf("Configuration file not found, using defaults")
+		// If we were passed in a configFile via -c, bail if it doesn't exist,
+		// otherwise ignore it: we can use the defaults
+		if configFile != "" || !os.IsNotExist(err) {
+			fatalf("error opening config file %v", err)
 		}
 	}
 
 	// At this point we either have the default value or the one set by the config.
 	// Either way, the command-line flag has precedence and overwrives the value
 	if trustDir != "" {
-		mainViper.Set("trustDir", trustDir)
+		mainViper.Set("trust_dir", trustDir)
 	}
 
 	// Expands all the possible ~/ that have been given, either through -d or config
 	// If there is no error, user it, if not, attempt to use whatever the user gave us
-	expandedTrustDir, err := homedir.Expand(mainViper.GetString("trustDir"))
+	expandedTrustDir, err := homedir.Expand(mainViper.GetString("trust_dir"))
 	if err == nil {
-		mainViper.Set("trustDir", expandedTrustDir)
+		mainViper.Set("trust_dir", expandedTrustDir)
 	}
-	logrus.Debugf("using the following trust directory: %s", mainViper.GetString("trustDir"))
+	logrus.Debugf("Using the following trust directory: %s", mainViper.GetString("trust_dir"))
 }
 
 func setupCommand(notaryCmd *cobra.Command) {
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index 299bb18f77..f311c2b565 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -94,7 +94,7 @@ func tufAdd(cmd *cobra.Command, args []string) {
 
 	// no online operations are performed by add so the transport argument
 	// should be nil
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -121,7 +121,7 @@ func tufInit(cmd *cobra.Command, args []string) {
 	parseConfig()
 	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -157,7 +157,7 @@ func tufList(cmd *cobra.Command, args []string) {
 	parseConfig()
 	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -184,7 +184,7 @@ func tufLookup(cmd *cobra.Command, args []string) {
 	gun := args[0]
 	targetName := args[1]
 
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -206,7 +206,7 @@ func tufStatus(cmd *cobra.Command, args []string) {
 	parseConfig()
 	gun := args[0]
 
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -240,7 +240,7 @@ func tufPublish(cmd *cobra.Command, args []string) {
 
 	cmd.Println("Pushing changes to", gun)
 
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), getTransport(gun, false), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -263,7 +263,7 @@ func tufRemove(cmd *cobra.Command, args []string) {
 
 	// no online operation are performed by remove so the transport argument
 	// should be nil.
-	repo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), nil, retriever)
+	repo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), nil, retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
@@ -291,7 +291,7 @@ func verify(cmd *cobra.Command, args []string) {
 
 	gun := args[0]
 	targetName := args[1]
-	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trustDir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
+	nRepo, err := notaryclient.NewNotaryRepository(mainViper.GetString("trust_dir"), gun, getRemoteTrustServer(), getTransport(gun, true), retriever)
 	if err != nil {
 		fatalf(err.Error())
 	}
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikeystore.go
index 52f106a718..ac51db00b8 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikeystore.go
@@ -185,9 +185,8 @@ func addECDSAKey(
 	role string,
 	backupStore KeyStore,
 ) error {
-	logrus.Debugf("Got into add key with key: %s\n", privKey.ID())
+	logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID())
 
-	// TODO(diogo): Figure out CKU_SO with yubikey
 	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN)
 	if err != nil {
 		return err
@@ -201,7 +200,6 @@ func addECDSAKey(
 	}
 
 	ecdsaPrivKeyD := ensurePrivateKeySize(ecdsaPrivKey.D.Bytes())
-	logrus.Debugf("Getting D bytes: %v\n", ecdsaPrivKeyD)
 
 	template, err := NewCertificate(role)
 	if err != nil {
@@ -262,16 +260,16 @@ func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []by
 	}
 
 	if err := ctx.FindObjectsInit(session, findTemplate); err != nil {
-		logrus.Debugf("Failed to init: %s\n", err.Error())
+		logrus.Debugf("Failed to init: %s", err.Error())
 		return nil, "", err
 	}
-	obj, b, err := ctx.FindObjects(session, 1)
+	obj, _, err := ctx.FindObjects(session, 1)
 	if err != nil {
-		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		logrus.Debugf("Failed to find objects: %v", err)
 		return nil, "", err
 	}
 	if err := ctx.FindObjectsFinal(session); err != nil {
-		logrus.Debugf("Failed to finalize: %s\n", err.Error())
+		logrus.Debugf("Failed to finalize: %s", err.Error())
 		return nil, "", err
 	}
 	if len(obj) != 1 {
@@ -282,7 +280,7 @@ func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []by
 	// Retrieve the public-key material to be able to create a new HSMRSAKey
 	attr, err := ctx.GetAttributeValue(session, obj[0], attrTemplate)
 	if err != nil {
-		logrus.Debugf("Failed to get Attribute for: %v\n", obj[0])
+		logrus.Debugf("Failed to get Attribute for: %v", obj[0])
 		return nil, "", err
 	}
 
@@ -302,8 +300,6 @@ func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []by
 		return nil, "", err
 	}
 
-	// TODO(diogo): Actually get the right alias from the certificate instead of
-	// alwars returning data.CanonicalRootRole
 	return data.NewECDSAPublicKey(pubBytes), data.CanonicalRootRole, nil
 }
 
@@ -324,13 +320,16 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	}
 
 	if err := ctx.FindObjectsInit(session, privateKeyTemplate); err != nil {
+		logrus.Debugf("Failed to init find objects: %s", err.Error())
 		return nil, err
 	}
 	obj, _, err := ctx.FindObjects(session, 1)
 	if err != nil {
+		logrus.Debugf("Failed to find objects: %v", err)
 		return nil, err
 	}
 	if err = ctx.FindObjectsFinal(session); err != nil {
+		logrus.Debugf("Failed to finalize find objects: %s", err.Error())
 		return nil, err
 	}
 	if len(obj) != 1 {
@@ -374,27 +373,27 @@ func yubiRemoveKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []
 	}
 
 	if err := ctx.FindObjectsInit(session, template); err != nil {
-		logrus.Printf("Failed to init: %s\n", err.Error())
+		logrus.Debugf("Failed to init find objects: %s", err.Error())
 		return err
 	}
 	obj, b, err := ctx.FindObjects(session, 1)
 	if err != nil {
-		logrus.Printf("Failed to find: %s %v\n", err.Error(), b)
+		logrus.Debugf("Failed to find objects: %s %v", err.Error(), b)
 		return err
 	}
 	if err := ctx.FindObjectsFinal(session); err != nil {
-		logrus.Printf("Failed to finalize: %s\n", err.Error())
+		logrus.Debugf("Failed to finalize find objects: %s", err.Error())
 		return err
 	}
 	if len(obj) != 1 {
-		logrus.Printf("should have found one object")
+		logrus.Debugf("should have found exactly one object")
 		return err
 	}
 
 	// Delete the certificate
 	err = ctx.DestroyObject(session, obj[0])
 	if err != nil {
-		logrus.Printf("Failed to delete cert")
+		logrus.Debugf("Failed to delete cert")
 		return err
 	}
 	return nil
@@ -414,7 +413,7 @@ func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[strin
 	}
 
 	if err = ctx.FindObjectsInit(session, findTemplate); err != nil {
-		logrus.Debugf("Failed to init: %s\n", err.Error())
+		logrus.Debugf("Failed to init: %s", err.Error())
 		return
 	}
 	objs, b, err := ctx.FindObjects(session, numSlots)
@@ -430,13 +429,13 @@ func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[strin
 		objs = append(objs, o...)
 	}
 	if err != nil {
-		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		logrus.Debugf("Failed to find: %s %v", err.Error(), b)
 		if len(objs) == 0 {
 			return nil, err
 		}
 	}
 	if err = ctx.FindObjectsFinal(session); err != nil {
-		logrus.Debugf("Failed to finalize: %s\n", err.Error())
+		logrus.Debugf("Failed to finalize: %s", err.Error())
 		return
 	}
 	if len(objs) == 0 {
@@ -451,7 +450,7 @@ func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[strin
 		// Retrieve the public-key material to be able to create a new HSMRSAKey
 		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
 		if err != nil {
-			logrus.Debugf("Failed to get Attribute for: %v\n", obj)
+			logrus.Debugf("Failed to get Attribute for: %v", obj)
 			continue
 		}
 
@@ -502,7 +501,7 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 	}
 
 	if err := ctx.FindObjectsInit(session, findTemplate); err != nil {
-		logrus.Debugf("Failed to init: %s\n", err.Error())
+		logrus.Debugf("Failed to init: %s", err.Error())
 		return nil, err
 	}
 	objs, b, err := ctx.FindObjects(session, numSlots)
@@ -521,14 +520,13 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 	}
 	taken := make(map[int]bool)
 	if err != nil {
-		logrus.Debugf("Failed to find: %s %v\n", err.Error(), b)
+		logrus.Debugf("Failed to find: %s %v", err.Error(), b)
 		return nil, err
 	}
 	for _, obj := range objs {
 		// Retrieve the slot ID
 		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
 		if err != nil {
-			logrus.Debugf("Failed to get Attribute for: %v\n", obj)
 			continue
 		}
 
@@ -592,14 +590,17 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
+		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
 	defer cleanup(ctx, session)
 	keys, err := yubiListKeys(ctx, session)
 	if err != nil {
+		logrus.Debugf("Failed to list key from the yubikey: %s", err.Error())
 		return nil
 	}
 	s.keys = keys
+
 	return buildKeyMap(keys)
 }
 
@@ -612,11 +613,12 @@ func (s *YubiKeyStore) addKey(
 	keyID, role string, privKey data.PrivateKey, backup bool) error {
 	// We only allow adding root keys for now
 	if role != data.CanonicalRootRole {
-		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s\n", role, keyID)
+		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s", role, keyID)
 	}
 
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
+		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return err
 	}
 	defer cleanup(ctx, session)
@@ -630,9 +632,10 @@ func (s *YubiKeyStore) addKey(
 
 	slot, err := getNextEmptySlot(ctx, session)
 	if err != nil {
+		logrus.Debugf("Failed to get an empty yubikey slot: %s", err.Error())
 		return err
 	}
-	logrus.Debugf("Using yubikey slot %v", slot)
+	logrus.Debugf("Attempting to store key using yubikey slot %v", slot)
 
 	backupStore := s.backupStore
 	if !backup {
@@ -648,6 +651,8 @@ func (s *YubiKeyStore) addKey(
 		}
 		return nil
 	}
+	logrus.Debugf("Failed to add key to yubikey: %v", err)
+
 	return err
 }
 
@@ -656,6 +661,7 @@ func (s *YubiKeyStore) addKey(
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
+		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil, "", err
 	}
 	defer cleanup(ctx, session)
@@ -667,11 +673,12 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 
 	pubKey, alias, err := getECDSAKey(ctx, session, key.slotID)
 	if err != nil {
+		logrus.Debugf("Failed to get key from slot %s: %s", key.slotID, err.Error())
 		return nil, "", err
 	}
 	// Check to see if we're returning the intended keyID
 	if pubKey.ID() != keyID {
-		return nil, "", fmt.Errorf("expected root key: %s, but found: %s\n", keyID, pubKey.ID())
+		return nil, "", fmt.Errorf("expected root key: %s, but found: %s", keyID, pubKey.ID())
 	}
 	privKey := NewYubiPrivateKey(key.slotID, *pubKey, s.passRetriever)
 	if privKey == nil {
@@ -686,6 +693,7 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib)
 	if err != nil {
+		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
 	defer cleanup(ctx, session)
@@ -696,7 +704,10 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	err = yubiRemoveKey(ctx, session, key.slotID, s.passRetriever, keyID)
 	if err == nil {
 		delete(s.keys, keyID)
+	} else {
+		logrus.Debugf("Failed to remove from the yubikey KeyID %s: %v", keyID, err)
 	}
+
 	return err
 }
 
@@ -712,6 +723,7 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 	privKey, _, err := GetPasswdDecryptBytes(
 		s.passRetriever, pemBytes, "", "imported root")
 	if err != nil {
+		logrus.Debugf("Failed to get and retrieve a key from: %s", keyPath)
 		return err
 	}
 	if keyPath != data.CanonicalRootRole {
@@ -738,7 +750,7 @@ func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error)
 	}
 
 	if err := p.Initialize(); err != nil {
-		return nil, 0, fmt.Errorf("Initialize error %s\n", err.Error())
+		return nil, 0, fmt.Errorf("Initialize error %s", err.Error())
 	}
 
 	slots, err := p.GetSlotList(true)

From 4c2fcda62072e9183b235b2397184361ef343e45 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Wed, 11 Nov 2015 11:50:18 -0800
Subject: [PATCH 67/85] Addressing small nits

Signed-off-by: Diogo Monica <diogo@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Diogo Monica <diogo@docker.com> (github: endophage)
---
 cmd/notary/keys.go | 2 ++
 cmd/notary/main.go | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index 8e014c52f5..e8d2554c00 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -137,6 +137,8 @@ func keysList(cmd *cobra.Command, args []string) {
 }
 
 func keysGenerateRootKey(cmd *cobra.Command, args []string) {
+	// We require one or no arguments (since we have a default value), but if the
+	// user passes in more than one argument, we error out.
 	if len(args) > 1 {
 		cmd.Usage()
 		fatalf("Please provide only one Algorithm as an argument to generate (rsa, ecdsa)")
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index 805ef928eb..7031a38068 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -82,13 +82,13 @@ func parseConfig() {
 	}
 
 	// At this point we either have the default value or the one set by the config.
-	// Either way, the command-line flag has precedence and overwrives the value
+	// Either way, the command-line flag has precedence and overwrites the value
 	if trustDir != "" {
 		mainViper.Set("trust_dir", trustDir)
 	}
 
 	// Expands all the possible ~/ that have been given, either through -d or config
-	// If there is no error, user it, if not, attempt to use whatever the user gave us
+	// If there is no error, use it, if not, attempt to use whatever the user gave us
 	expandedTrustDir, err := homedir.Expand(mainViper.GetString("trust_dir"))
 	if err == nil {
 		mainViper.Set("trust_dir", expandedTrustDir)

From 8628b57a963a6e90485a615a14a6f05906464fdd Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 11 Nov 2015 15:48:12 -0800
Subject: [PATCH 68/85] private subdir should be added by keyfilestore, rather
 than all over the place Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 client/repo.go                          |  3 +--
 client/repo_pkcs11.go                   |  6 ++---
 cmd/notary/cert.go                      | 12 +++------
 cmd/notary/keys.go                      |  6 ++---
 const.go                                |  2 --
 cryptoservice/import_export.go          | 35 ++++++++-----------------
 cryptoservice/import_export_test.go     | 30 ++++++++++-----------
 keystoremanager/keystoremanager_test.go |  8 ++----
 trustmanager/keyfilestore.go            |  2 ++
 trustmanager/keyfilestore_test.go       | 10 +++----
 10 files changed, 44 insertions(+), 70 deletions(-)

diff --git a/client/repo.go b/client/repo.go
index 97cba741af..43f4ed78ce 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -20,8 +20,7 @@ import (
 // (usually ~/.docker/trust/).
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
-	keysPath := filepath.Join(baseDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
 	}
diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index ed82bd555b..933accc439 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"path/filepath"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
@@ -22,10 +21,9 @@ import (
 func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 
-	keysPath := filepath.Join(baseDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
+		return nil, fmt.Errorf("failed to create private key store in directory: %s", baseDir)
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
diff --git a/cmd/notary/cert.go b/cmd/notary/cert.go
index 95ae44e03a..a21e6979f3 100644
--- a/cmd/notary/cert.go
+++ b/cmd/notary/cert.go
@@ -4,10 +4,8 @@ import (
 	"crypto/x509"
 	"math"
 	"os"
-	"path/filepath"
 	"time"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/trustmanager"
 
@@ -56,10 +54,9 @@ func certRemove(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	trustDir := mainViper.GetString("trust_dir")
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(trustDir, retriever)
 	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", trustDir)
 	}
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
@@ -125,10 +122,9 @@ func certList(cmd *cobra.Command, args []string) {
 	parseConfig()
 
 	trustDir := mainViper.GetString("trust_dir")
-	keysPath := filepath.Join(trustDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, retriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(trustDir, retriever)
 	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", trustDir)
 	}
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(trustDir, fileKeyStore)
 	if err != nil {
diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index e8d2554c00..b3e378c200 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -7,7 +7,6 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/docker/notary"
 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/passphrase"
@@ -341,10 +340,9 @@ func keysRotate(cmd *cobra.Command, args []string) {
 func getKeyStores(cmd *cobra.Command, directory string,
 	ret passphrase.Retriever, withHardware bool) []trustmanager.KeyStore {
 
-	keysPath := filepath.Join(directory, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, ret)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(directory, ret)
 	if err != nil {
-		fatalf("Failed to create private key store in directory: %s", keysPath)
+		fatalf("Failed to create private key store in directory: %s", directory)
 	}
 
 	ks := []trustmanager.KeyStore{fileKeyStore}
diff --git a/const.go b/const.go
index 41d80de393..3c22c05024 100644
--- a/const.go
+++ b/const.go
@@ -2,8 +2,6 @@ package notary
 
 // application wide constants
 const (
-	BackupDir    = "backup"
-	PrivDir      = "private"
 	PrivKeyPerms = 0700
 	PubCertPerms = 0755
 )
diff --git a/cryptoservice/import_export.go b/cryptoservice/import_export.go
index 66405b22e3..4f5bd4ca82 100644
--- a/cryptoservice/import_export.go
+++ b/cryptoservice/import_export.go
@@ -11,7 +11,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 )
@@ -72,8 +71,7 @@ func (cs *CryptoService) ExportRootKeyReencrypt(dest io.Writer, keyID string, ne
 	tempBaseDir, err := ioutil.TempDir("", "notary-key-export-")
 	defer os.RemoveAll(tempBaseDir)
 
-	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
-	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
+	tempKeyStore, err := trustmanager.NewKeyFileStore(tempBaseDir, newPassphraseRetriever)
 	if err != nil {
 		return err
 	}
@@ -127,8 +125,7 @@ func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever pa
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
-	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, newPassphraseRetriever)
+	tempKeyStore, err := trustmanager.NewKeyFileStore(tempBaseDir, newPassphraseRetriever)
 	if err != nil {
 		return err
 	}
@@ -141,7 +138,7 @@ func (cs *CryptoService) ExportAllKeys(dest io.Writer, newPassphraseRetriever pa
 
 	zipWriter := zip.NewWriter(dest)
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, notary.PrivDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore); err != nil {
 		return err
 	}
 
@@ -176,21 +173,12 @@ func (cs *CryptoService) ImportKeysZip(zipReader zip.Reader) error {
 
 		// Note that using / as a separator is okay here - the zip
 		// package guarantees that the separator will be /
-		if strings.HasPrefix(fNameTrimmed, notary.PrivDir) {
-			if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
-				if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
-					return err
-				}
+		if fNameTrimmed[len(fNameTrimmed)-5:] == "_root" {
+			if err = checkRootKeyIsEncrypted(fileBytes); err != nil {
+				return err
 			}
-			keyName := strings.TrimPrefix(fNameTrimmed, notary.PrivDir)
-			newKeys[keyName] = fileBytes
-		} else {
-			// This path inside the zip archive doesn't look like a
-			// root key, non-root key, or alias. To avoid adding a file
-			// to the filestore that we won't be able to use, skip
-			// this file in the import.
-			continue
 		}
+		newKeys[fNameTrimmed] = fileBytes
 	}
 
 	for keyName, pemBytes := range newKeys {
@@ -224,8 +212,7 @@ func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseR
 	defer os.RemoveAll(tempBaseDir)
 
 	// Create temporary keystore to use as a staging area
-	tempKeysPath := filepath.Join(tempBaseDir, notary.PrivDir)
-	tempKeyStore, err := trustmanager.NewKeyFileStore(tempKeysPath, passphraseRetriever)
+	tempKeyStore, err := trustmanager.NewKeyFileStore(tempBaseDir, passphraseRetriever)
 	if err != nil {
 		return err
 	}
@@ -242,7 +229,7 @@ func (cs *CryptoService) ExportKeysByGUN(dest io.Writer, gun string, passphraseR
 		return ErrNoKeysFoundForGUN
 	}
 
-	if err := addKeysToArchive(zipWriter, tempKeyStore, notary.PrivDir); err != nil {
+	if err := addKeysToArchive(zipWriter, tempKeyStore); err != nil {
 		return err
 	}
 
@@ -289,7 +276,7 @@ func moveKeys(oldKeyStore, newKeyStore trustmanager.KeyStore) error {
 	return nil
 }
 
-func addKeysToArchive(zipWriter *zip.Writer, newKeyStore *trustmanager.KeyFileStore, subDir string) error {
+func addKeysToArchive(zipWriter *zip.Writer, newKeyStore *trustmanager.KeyFileStore) error {
 	for _, relKeyPath := range newKeyStore.ListFiles() {
 		fullKeyPath := filepath.Join(newKeyStore.BaseDir(), relKeyPath)
 
@@ -303,7 +290,7 @@ func addKeysToArchive(zipWriter *zip.Writer, newKeyStore *trustmanager.KeyFileSt
 			return err
 		}
 
-		infoHeader.Name = filepath.Join(subDir, relKeyPath)
+		infoHeader.Name = relKeyPath
 
 		zipFileEntryWriter, err := zipWriter.CreateHeader(infoHeader)
 		if err != nil {
diff --git a/cryptoservice/import_export_test.go b/cryptoservice/import_export_test.go
index 6b9ced61b4..e6e762581f 100644
--- a/cryptoservice/import_export_test.go
+++ b/cryptoservice/import_export_test.go
@@ -48,7 +48,7 @@ func TestImportExportZip(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), newPassphraseRetriever)
+	fileStore, err := trustmanager.NewKeyFileStore(tempBaseDir, newPassphraseRetriever)
 	cs := NewCryptoService(gun, fileStore)
 	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
 	assert.NoError(t, err)
@@ -80,13 +80,13 @@ func TestImportExportZip(t *testing.T) {
 		if alias == "root" {
 			continue
 		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+		relKeyPath := filepath.Join("tuf_keys", privKeyName+"_"+alias+".key")
 		passphraseByFile[relKeyPath] = exportPassphrase
 	}
 
 	// Add root key to the map. This will use the export passphrase because it
 	// will be reencrypted.
-	relRootKey := filepath.Join("private", "root_keys", rootKeyID+"_root.key")
+	relRootKey := filepath.Join("root_keys", rootKeyID+"_root.key")
 	passphraseByFile[relRootKey] = exportPassphrase
 
 	// Iterate through the files in the archive, checking that the files
@@ -123,7 +123,7 @@ func TestImportExportZip(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir2)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	fileStore2, err := trustmanager.NewKeyFileStore(tempBaseDir2, newPassphraseRetriever)
 	assert.NoError(t, err)
 	cs2 := NewCryptoService(gun, fileStore2)
 
@@ -145,8 +145,8 @@ func TestImportExportZip(t *testing.T) {
 		if alias == "root" {
 			continue
 		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+		relKeyPath := filepath.Join("tuf_keys", privKeyName+"_"+alias+".key")
+		privKeyFileName := filepath.Join(tempBaseDir2, "private", relKeyPath)
 		_, err = os.Stat(privKeyFileName)
 		assert.NoError(t, err, "missing private key for role %s: %s", alias, privKeyName)
 	}
@@ -167,7 +167,7 @@ func TestImportExportGUN(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), newPassphraseRetriever)
+	fileStore, err := trustmanager.NewKeyFileStore(tempBaseDir, newPassphraseRetriever)
 	cs := NewCryptoService(gun, fileStore)
 	_, err = cs.Create(data.CanonicalRootRole, data.ECDSAKey)
 	_, err = cs.Create(data.CanonicalTargetsRole, data.ECDSAKey)
@@ -205,7 +205,7 @@ func TestImportExportGUN(t *testing.T) {
 		if alias == "root" {
 			continue
 		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
+		relKeyPath := filepath.Join("tuf_keys", privKeyName+"_"+alias+".key")
 
 		passphraseByFile[relKeyPath] = exportPassphrase
 	}
@@ -245,7 +245,7 @@ func TestImportExportGUN(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir2)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	fileStore2, err := trustmanager.NewKeyFileStore(tempBaseDir2, newPassphraseRetriever)
 	cs2 := NewCryptoService(gun, fileStore2)
 
 	// Reopen the zip file for importing
@@ -270,8 +270,8 @@ func TestImportExportGUN(t *testing.T) {
 		if alias == "root" {
 			continue
 		}
-		relKeyPath := filepath.Join("private", "tuf_keys", privKeyName+"_"+alias+".key")
-		privKeyFileName := filepath.Join(tempBaseDir2, relKeyPath)
+		relKeyPath := filepath.Join("tuf_keys", privKeyName+"_"+alias+".key")
+		privKeyFileName := filepath.Join(tempBaseDir2, "private", relKeyPath)
 		_, err = os.Stat(privKeyFileName)
 		assert.NoError(t, err)
 	}
@@ -285,7 +285,7 @@ func TestImportExportRootKey(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), oldPassphraseRetriever)
+	fileStore, err := trustmanager.NewKeyFileStore(tempBaseDir, oldPassphraseRetriever)
 	cs := NewCryptoService(gun, fileStore)
 	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
 	assert.NoError(t, err)
@@ -305,7 +305,7 @@ func TestImportExportRootKey(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir2)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), oldPassphraseRetriever)
+	fileStore2, err := trustmanager.NewKeyFileStore(tempBaseDir2, oldPassphraseRetriever)
 	cs2 := NewCryptoService(gun, fileStore2)
 
 	keyReader, err := os.Open(tempKeyFilePath)
@@ -353,7 +353,7 @@ func TestImportExportRootKeyReencrypt(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir, "private"), oldPassphraseRetriever)
+	fileStore, err := trustmanager.NewKeyFileStore(tempBaseDir, oldPassphraseRetriever)
 	cs := NewCryptoService(gun, fileStore)
 	pubKey, err := cs.Create(data.CanonicalRootRole, data.ECDSAKey)
 	assert.NoError(t, err)
@@ -373,7 +373,7 @@ func TestImportExportRootKeyReencrypt(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir2)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	fileStore2, err := trustmanager.NewKeyFileStore(filepath.Join(tempBaseDir2, "private"), newPassphraseRetriever)
+	fileStore2, err := trustmanager.NewKeyFileStore(tempBaseDir2, newPassphraseRetriever)
 	cs2 := NewCryptoService(gun, fileStore2)
 
 	keyReader, err := os.Open(tempKeyFilePath)
diff --git a/keystoremanager/keystoremanager_test.go b/keystoremanager/keystoremanager_test.go
index 1c5d3e316f..9304b5971c 100644
--- a/keystoremanager/keystoremanager_test.go
+++ b/keystoremanager/keystoremanager_test.go
@@ -6,11 +6,9 @@ import (
 	"encoding/json"
 	"io/ioutil"
 	"os"
-	"path/filepath"
 	"testing"
 	"text/template"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
@@ -123,8 +121,7 @@ func TestValidateRoot(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	keysPath := filepath.Join(tempBaseDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(tempBaseDir, passphraseRetriever)
 	assert.NoError(t, err)
 
 	// Create a FileStoreManager
@@ -235,8 +232,7 @@ func filestoreWithTwoCerts(t *testing.T, gun, keyAlg string) (
 	tempBaseDir, err := ioutil.TempDir("", "notary-test-")
 	assert.NoError(t, err, "failed to create a temporary directory: %s", err)
 
-	keysPath := filepath.Join(tempBaseDir, notary.PrivDir)
-	fileKeyStore, err := trustmanager.NewKeyFileStore(keysPath, passphraseRetriever)
+	fileKeyStore, err := trustmanager.NewKeyFileStore(tempBaseDir, passphraseRetriever)
 	assert.NoError(t, err)
 
 	// Create a FileStoreManager
diff --git a/trustmanager/keyfilestore.go b/trustmanager/keyfilestore.go
index b8148c58ca..58edaea1fd 100644
--- a/trustmanager/keyfilestore.go
+++ b/trustmanager/keyfilestore.go
@@ -13,6 +13,7 @@ import (
 const (
 	rootKeysSubdir    = "root_keys"
 	nonRootKeysSubdir = "tuf_keys"
+	privDir           = "private"
 )
 
 // KeyFileStore persists and manages private keys on disk
@@ -34,6 +35,7 @@ type KeyMemoryStore struct {
 // NewKeyFileStore returns a new KeyFileStore creating a private directory to
 // hold the keys.
 func NewKeyFileStore(baseDir string, passphraseRetriever passphrase.Retriever) (*KeyFileStore, error) {
+	baseDir = filepath.Join(baseDir, privDir)
 	fileStore, err := NewPrivateSimpleFileStore(baseDir, keyExtension)
 	if err != nil {
 		return nil, err
diff --git a/trustmanager/keyfilestore_test.go b/trustmanager/keyfilestore_test.go
index 16e39f31f5..dabfb98e62 100644
--- a/trustmanager/keyfilestore_test.go
+++ b/trustmanager/keyfilestore_test.go
@@ -34,7 +34,7 @@ func TestAddKey(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 
 	// Since we're generating this manually we need to add the extension '.'
-	expectedFilePath := filepath.Join(tempBaseDir, rootKeysSubdir, testName+"_"+testAlias+"."+testExt)
+	expectedFilePath := filepath.Join(tempBaseDir, privDir, rootKeysSubdir, testName+"_"+testAlias+"."+testExt)
 
 	// Create our store
 	store, err := NewKeyFileStore(tempBaseDir, passphraseRetriever)
@@ -95,7 +95,7 @@ EMl3eFOJXjIch/wIesRSN+2dGOsl7neercjMh1i9RvpCwHDx/E0=
 	defer os.RemoveAll(tempBaseDir)
 
 	// Since we're generating this manually we need to add the extension '.'
-	filePath := filepath.Join(tempBaseDir, rootKeysSubdir, testName+"_"+testAlias+"."+testExt)
+	filePath := filepath.Join(tempBaseDir, privDir, rootKeysSubdir, testName+"_"+testAlias+"."+testExt)
 
 	os.MkdirAll(filepath.Dir(filePath), perms)
 	err = ioutil.WriteFile(filePath, testData, perms)
@@ -159,7 +159,7 @@ func TestListKeys(t *testing.T) {
 	assert.Equal(t, role, "targets")
 
 	// Write an invalid filename to the directory
-	filePath := filepath.Join(tempBaseDir, rootKeysSubdir, "fakekeyname.key")
+	filePath := filepath.Join(tempBaseDir, privDir, rootKeysSubdir, "fakekeyname.key")
 	err = ioutil.WriteFile(filePath, []byte("data"), perms)
 	assert.NoError(t, err, "failed to write test file")
 
@@ -213,7 +213,7 @@ func TestGetDecryptedWithTamperedCipherText(t *testing.T) {
 	assert.NoError(t, err, "failed to add key to store")
 
 	// Since we're generating this manually we need to add the extension '.'
-	expectedFilePath := filepath.Join(tempBaseDir, rootKeysSubdir, privKey.ID()+"_"+testAlias+"."+testExt)
+	expectedFilePath := filepath.Join(tempBaseDir, privDir, rootKeysSubdir, privKey.ID()+"_"+testAlias+"."+testExt)
 
 	// Get file description, open file
 	fp, err := os.OpenFile(expectedFilePath, os.O_WRONLY, 0600)
@@ -320,7 +320,7 @@ func TestRemoveKey(t *testing.T) {
 	defer os.RemoveAll(tempBaseDir)
 
 	// Since we're generating this manually we need to add the extension '.'
-	expectedFilePath := filepath.Join(tempBaseDir, nonRootKeysSubdir, testName+"_"+testAlias+"."+testExt)
+	expectedFilePath := filepath.Join(tempBaseDir, privDir, nonRootKeysSubdir, testName+"_"+testAlias+"."+testExt)
 
 	// Create our store
 	store, err := NewKeyFileStore(tempBaseDir, passphraseRetriever)

From ca7e4c8d382c8003328079ef5c7ff3c3c1f62fda Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 11 Nov 2015 18:44:31 -0800
Subject: [PATCH 69/85] set withHardware flag to false for export commands. We
 can never export from hardware Signed-off-by: David Lawrence
 <david.lawrence@docker.com> (github: endophage)

---
 cmd/notary/keys.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/notary/keys.go b/cmd/notary/keys.go
index b3e378c200..0d1d5e07e0 100644
--- a/cmd/notary/keys.go
+++ b/cmd/notary/keys.go
@@ -189,7 +189,7 @@ func keysExport(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, false)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)
@@ -234,7 +234,7 @@ func keysExportRoot(cmd *cobra.Command, args []string) {
 
 	cs := cryptoservice.NewCryptoService(
 		"",
-		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, true)...,
+		getKeyStores(cmd, mainViper.GetString("trust_dir"), retriever, false)...,
 	)
 
 	exportFile, err := os.Create(exportFilename)

From 9b8645c39f2c315f54a8adc7c04445921b46edf4 Mon Sep 17 00:00:00 2001
From: David Lawrence <david.lawrence@docker.com>
Date: Wed, 11 Nov 2015 18:27:26 -0800
Subject: [PATCH 70/85] add verification to yubikey signatures. Attempt to
 generate sig up to 5 times, fail if all 5 are invalid Signed-off-by: David
 Lawrence <david.lawrence@docker.com> (github: endophage)

---
 client/repo_pkcs11.go                         |  3 +-
 cmd/notary/integration_pkcs11_test.go         | 14 ++++----
 cmd/notary/keys_pkcs11.go                     |  3 +-
 trustmanager/{ => yubikey}/pkcs11_darwin.go   |  2 +-
 trustmanager/{ => yubikey}/pkcs11_linux.go    |  2 +-
 trustmanager/{ => yubikey}/yubikeystore.go    | 35 ++++++++++++-------
 .../{ => yubikey}/yubikeystore_test.go        | 19 +++++-----
 7 files changed, 45 insertions(+), 33 deletions(-)
 rename trustmanager/{ => yubikey}/pkcs11_darwin.go (86%)
 rename trustmanager/{ => yubikey}/pkcs11_linux.go (88%)
 rename trustmanager/{ => yubikey}/yubikeystore.go (96%)
 rename trustmanager/{ => yubikey}/yubikeystore_test.go (86%)

diff --git a/client/repo_pkcs11.go b/client/repo_pkcs11.go
index ed82bd555b..1d2813f922 100644
--- a/client/repo_pkcs11.go
+++ b/client/repo_pkcs11.go
@@ -12,6 +12,7 @@ import (
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/trustmanager/yubikey"
 	"github.com/docker/notary/tuf/signed"
 	"github.com/docker/notary/tuf/store"
 )
@@ -29,7 +30,7 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)
-	yubiKeyStore, _ := trustmanager.NewYubiKeyStore(fileKeyStore, retriever)
+	yubiKeyStore, _ := yubikey.NewYubiKeyStore(fileKeyStore, retriever)
 	var cryptoService signed.CryptoService
 	if yubiKeyStore == nil {
 		cryptoService = cryptoservice.NewCryptoService(gun, keyStoreManager.KeyStore)
diff --git a/cmd/notary/integration_pkcs11_test.go b/cmd/notary/integration_pkcs11_test.go
index 6f29ad0c08..77ffc0e991 100644
--- a/cmd/notary/integration_pkcs11_test.go
+++ b/cmd/notary/integration_pkcs11_test.go
@@ -6,12 +6,12 @@ import (
 	"testing"
 
 	"github.com/docker/notary/passphrase"
-	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/trustmanager/yubikey"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/assert"
 )
 
-var rootOnHardware = trustmanager.YubikeyAccessible
+var rootOnHardware = yubikey.YubikeyAccessible
 
 // Per-test set up that returns a cleanup function.  This set up:
 // - changes the passphrase retriever to always produce a constant passphrase
@@ -29,10 +29,10 @@ func setUp(t *testing.T) func() {
 
 	retriever = fake
 	getRetriever = func() passphrase.Retriever { return fake }
-	trustmanager.SetYubikeyKeyMode(trustmanager.KeymodeNone)
+	yubikey.SetYubikeyKeyMode(yubikey.KeymodeNone)
 
 	// //we're just removing keys here, so nil is fine
-	s, err := trustmanager.NewYubiKeyStore(nil, retriever)
+	s, err := yubikey.NewYubiKeyStore(nil, retriever)
 	assert.NoError(t, err)
 	for k := range s.ListKeys() {
 		err := s.RemoveKey(k)
@@ -42,7 +42,7 @@ func setUp(t *testing.T) func() {
 	return func() {
 		retriever = oldRetriever
 		getRetriever = getPassphraseRetriever
-		trustmanager.SetYubikeyKeyMode(trustmanager.KeymodeTouch | trustmanager.KeymodePinOnce)
+		yubikey.SetYubikeyKeyMode(yubikey.KeymodeTouch | yubikey.KeymodePinOnce)
 	}
 }
 
@@ -51,9 +51,9 @@ func setUp(t *testing.T) func() {
 // on disk
 func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) {
 	// do not bother verifying if there is no yubikey available
-	if trustmanager.YubikeyAccessible() {
+	if yubikey.YubikeyAccessible() {
 		// //we're just getting keys here, so nil is fine
-		s, err := trustmanager.NewYubiKeyStore(nil, retriever)
+		s, err := yubikey.NewYubiKeyStore(nil, retriever)
 		assert.NoError(t, err)
 		privKey, role, err := s.GetKey(rootKeyID)
 		assert.NoError(t, err)
diff --git a/cmd/notary/keys_pkcs11.go b/cmd/notary/keys_pkcs11.go
index 87af9dad65..97b7af416d 100644
--- a/cmd/notary/keys_pkcs11.go
+++ b/cmd/notary/keys_pkcs11.go
@@ -5,8 +5,9 @@ package main
 import (
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
+	"github.com/docker/notary/trustmanager/yubikey"
 )
 
 func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
-	return trustmanager.NewYubiKeyStore(fileKeyStore, ret)
+	return yubikey.NewYubiKeyStore(fileKeyStore, ret)
 }
diff --git a/trustmanager/pkcs11_darwin.go b/trustmanager/yubikey/pkcs11_darwin.go
similarity index 86%
rename from trustmanager/pkcs11_darwin.go
rename to trustmanager/yubikey/pkcs11_darwin.go
index 63f1888b38..9d0040a31d 100644
--- a/trustmanager/pkcs11_darwin.go
+++ b/trustmanager/yubikey/pkcs11_darwin.go
@@ -1,6 +1,6 @@
 // +build pkcs11,darwin
 
-package trustmanager
+package yubikey
 
 var possiblePkcs11Libs = []string{
 	"/usr/local/lib/libykcs11.dylib",
diff --git a/trustmanager/pkcs11_linux.go b/trustmanager/yubikey/pkcs11_linux.go
similarity index 88%
rename from trustmanager/pkcs11_linux.go
rename to trustmanager/yubikey/pkcs11_linux.go
index 9765299914..61c7f14810 100644
--- a/trustmanager/pkcs11_linux.go
+++ b/trustmanager/yubikey/pkcs11_linux.go
@@ -1,6 +1,6 @@
 // +build pkcs11,linux
 
-package trustmanager
+package yubikey
 
 var possiblePkcs11Libs = []string{
 	"/usr/lib/libykcs11.so",
diff --git a/trustmanager/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
similarity index 96%
rename from trustmanager/yubikeystore.go
rename to trustmanager/yubikey/yubikeystore.go
index ac51db00b8..c3e55da0b7 100644
--- a/trustmanager/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -1,6 +1,6 @@
 // +build pkcs11
 
-package trustmanager
+package yubikey
 
 import (
 	"crypto"
@@ -17,7 +17,9 @@ import (
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
+	"github.com/docker/notary/tuf/signed"
 	"github.com/miekg/pkcs11"
 )
 
@@ -33,6 +35,8 @@ const (
 
 	// the key size, when importing a key into yubikey, MUST be 32 bytes
 	ecdsaPrivateKeySize = 32
+
+	sigAttempts = 5
 )
 
 // what key mode to use when generating keys
@@ -155,12 +159,17 @@ func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts
 	}
 	defer cleanup(ctx, session)
 
-	sig, err := sign(ctx, session, y.slot, y.passRetriever, msg)
-	if err != nil {
-		return nil, fmt.Errorf("failed to sign using Yubikey: %v", err)
+	v := signed.Verifiers[data.ECDSASignature]
+	for i := 0; i < sigAttempts; i++ {
+		sig, err := sign(ctx, session, y.slot, y.passRetriever, msg)
+		if err != nil {
+			return nil, fmt.Errorf("failed to sign using Yubikey: %v", err)
+		}
+		if err := v.Verify(&y.ECDSAPublicKey, sig, msg); err == nil {
+			return sig, nil
+		}
 	}
-
-	return sig, nil
+	return nil, errors.New("Failed to generate signature on Yubikey.")
 }
 
 // If a byte array is less than the number of bytes specified by
@@ -183,7 +192,7 @@ func addECDSAKey(
 	pkcs11KeyID []byte,
 	passRetriever passphrase.Retriever,
 	role string,
-	backupStore KeyStore,
+	backupStore trustmanager.KeyStore,
 ) error {
 	logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID())
 
@@ -201,7 +210,7 @@ func addECDSAKey(
 
 	ecdsaPrivKeyD := ensurePrivateKeySize(ecdsaPrivKey.D.Bytes())
 
-	template, err := NewCertificate(role)
+	template, err := trustmanager.NewCertificate(role)
 	if err != nil {
 		return fmt.Errorf("failed to create the certificate template: %v", err)
 	}
@@ -561,12 +570,12 @@ func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, er
 type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
-	backupStore   KeyStore
+	backupStore   trustmanager.KeyStore
 }
 
 // NewYubiKeyStore returns a YubiKeyStore, given a backup key store to write any
 // generated keys to (usually a KeyFileStore)
-func NewYubiKeyStore(backupStore KeyStore, passphraseRetriever passphrase.Retriever) (
+func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) (
 	*YubiKeyStore, error) {
 
 	s := &YubiKeyStore{
@@ -720,7 +729,7 @@ func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) {
 // ImportKey imports a root key into a Yubikey
 func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 	logrus.Debugf("Attempting to import: %s key inside of YubiKeyStore", keyPath)
-	privKey, _, err := GetPasswdDecryptBytes(
+	privKey, _, err := trustmanager.GetPasswdDecryptBytes(
 		s.passRetriever, pemBytes, "", "imported root")
 	if err != nil {
 		logrus.Debugf("Failed to get and retrieve a key from: %s", keyPath)
@@ -807,10 +816,10 @@ func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphra
 		passwd, giveup, err := passRetriever(user, "yubikey", false, attempts)
 		// Check if the passphrase retriever got an error or if it is telling us to give up
 		if giveup || err != nil {
-			return ErrPasswordInvalid{}
+			return trustmanager.ErrPasswordInvalid{}
 		}
 		if attempts > 2 {
-			return ErrAttemptsExceeded{}
+			return trustmanager.ErrAttemptsExceeded{}
 		}
 
 		// Try to convert PEM encoded bytes back to a PrivateKey using the passphrase
diff --git a/trustmanager/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
similarity index 86%
rename from trustmanager/yubikeystore_test.go
rename to trustmanager/yubikey/yubikeystore_test.go
index 6bbd9b8bc3..9d7863d62b 100644
--- a/trustmanager/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -1,6 +1,6 @@
 // +build pkcs11
 
-package trustmanager
+package yubikey
 
 import (
 	"crypto/rand"
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/docker/notary/passphrase"
+	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
 	"github.com/stretchr/testify/assert"
 )
@@ -17,7 +18,7 @@ func clearAllKeys(t *testing.T) {
 	// removing and then adding with the same YubiKeyStore causes
 	// non-deterministic failures at least on Mac OS
 	ret := passphrase.ConstantRetriever("passphrase")
-	store, err := NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 
 	for k := range store.ListKeys() {
@@ -53,7 +54,7 @@ func TestEnsurePrivateKeySizePadsLessThanRequiredSizeArrays(t *testing.T) {
 }
 
 func testAddKey(t *testing.T, store *YubiKeyStore) (data.PrivateKey, error) {
-	privKey, err := GenerateECDSAKey(rand.Reader)
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err)
 
 	err = store.AddKey(privKey.ID(), data.CanonicalRootRole, privKey)
@@ -67,7 +68,7 @@ func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 	clearAllKeys(t)
 
 	ret := passphrase.ConstantRetriever("passphrase")
-	store, err := NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 	SetYubikeyKeyMode(KeymodeNone)
 	defer func() {
@@ -84,7 +85,7 @@ func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
 	}
 
 	// create a new store, to make sure we're not just using the keys cache
-	store, err = NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	store, err = NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 	listedKeys := store.ListKeys()
 	assert.Len(t, listedKeys, numSlots)
@@ -114,7 +115,7 @@ func TestImportKey(t *testing.T) {
 	clearAllKeys(t)
 
 	ret := passphrase.ConstantRetriever("passphrase")
-	backup := NewKeyMemoryStore(ret)
+	backup := trustmanager.NewKeyMemoryStore(ret)
 	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
 	SetYubikeyKeyMode(KeymodeNone)
@@ -123,10 +124,10 @@ func TestImportKey(t *testing.T) {
 	}()
 
 	// generate key and import it
-	privKey, err := GenerateECDSAKey(rand.Reader)
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err)
 
-	pemBytes, err := EncryptPrivateKey(privKey, "passphrase")
+	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
 	err = store.ImportKey(pemBytes, "root")
@@ -138,7 +139,7 @@ func TestImportKey(t *testing.T) {
 
 	// ensure key is in Yubikey -  create a new store, to make sure we're not
 	// just using the keys cache
-	store, err = NewYubiKeyStore(NewKeyMemoryStore(ret), ret)
+	store, err = NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	gottenKey, role, err := store.GetKey(privKey.ID())
 	assert.NoError(t, err)
 	assert.Equal(t, data.CanonicalRootRole, role)

From cf85394b4c67b366338f25a8a73e55aa764e081e Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 18:04:28 -0800
Subject: [PATCH 71/85] Start running without the pkcs11 buildtag in CI, and
 generate coverage.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 Makefile       | 29 ++++++++++++++++-------------
 circle.yml     | 12 +++++++++++-
 client/repo.go |  3 +--
 3 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/Makefile b/Makefile
index e09918c1a7..d6b7dc4c10 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"
 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"
 GOOSES = darwin freebsd linux
 GOARCHS = amd64
-NOTARY_BUILDTAGS="pkcs11"
+NOTARY_BUILDTAGS ?= "pkcs11"
 GO_EXC = go
 NOTARYDIR := /go/src/github.com/docker/notary
 
@@ -27,6 +27,9 @@ else
 $(error You are importing pkcs11 somewhere and not using a build tag)
 endif
 
+_empty :=
+_space := $(empty) $(empty)
+
 # go cover test variables
 COVERDIR=.cover
 COVERPROFILE=$(COVERDIR)/cover.out
@@ -82,16 +85,16 @@ lint:
 
 build: go_version
 	@echo "+ $@"
-	@go build -tags ${NOTARY_BUILDTAGS} -v ${GO_LDFLAGS} ./...
+	@go build -tags "${NOTARY_BUILDTAGS}" -v ${GO_LDFLAGS} ./...
 
-test: OPTS =
+test: TESTOPTS =
 test: go_version
-	@echo "+ $@ $(OPTS)"
-	go test -tags ${NOTARY_BUILDTAGS} $(OPTS) ./...
+	@echo "+ $@ $(TESTOPTS)"
+	go test -tags "${NOTARY_BUILDTAGS}" $(TESTOPTS) ./...
 
 test-full: vet lint
 	@echo "+ $@"
-	go test -tags ${NOTARY_BUILDTAGS} -v ./...
+	go test -tags "${NOTARY_BUILDTAGS}" -v ./...
 
 protos:
 	@protoc --go_out=plugins=grpc:. proto/*.proto
@@ -103,25 +106,24 @@ protos:
 # be run first
 
 define gocover
-$(GO_EXC) test $(OPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).cover" "$(1)" || exit 1;
+$(GO_EXC) test $(OPTS) $(TESTOPTS) -covermode="$(COVERMODE)" -coverprofile="$(COVERDIR)/$(subst /,-,$(1)).$(subst $(_space),.,$(NOTARY_BUILDTAGS)).cover" "$(1)" || exit 1;
 endef
 
 gen-cover: go_version
-	@rm -rf "$(COVERDIR)"
 	@mkdir -p "$(COVERDIR)"
 	$(foreach PKG,$(PKGS),$(call gocover,$(PKG)))
 
 cover: GO_EXC := go
-       OPTS = -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
-cover: gen-cover
-	@gocovmerge $(shell ls -1 $(COVERDIR)/* | tr "\n" " ") > $(COVERPROFILE)
-	@go tool cover -func="$(COVERPROFILE)"
+       OPTS = -tags "${NOTARY_BUILDTAGS}" -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
+cover: gen-cover covmerge
 	@go tool cover -html="$(COVERPROFILE)"
 
 # Codecov knows how to merge multiple coverage files
-ci: OPTS = -tags ${NOTARY_BUILDTAGS} -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
+ci: OPTS = -tags "${NOTARY_BUILDTAGS}" -race -coverpkg "$(shell ./coverpkg.sh $(1) $(NOTARY_PKG))"
     GO_EXC := godep go
 ci: gen-cover
+
+covmerge:
 	@gocovmerge $(shell ls -1 $(COVERDIR)/* | tr "\n" " ") > $(COVERPROFILE)
 	@go tool cover -func="$(COVERPROFILE)"
 
@@ -157,4 +159,5 @@ shell: notary-dockerfile
 
 clean:
 	@echo "+ $@"
+	@rm -rf "$(COVERDIR)"
 	@rm -rf "${PREFIX}/bin/notary-server" "${PREFIX}/bin/notary" "${PREFIX}/bin/notary-signer"
diff --git a/circle.yml b/circle.yml
index fb89862fed..a40e94b5c5 100644
--- a/circle.yml
+++ b/circle.yml
@@ -45,6 +45,10 @@ test:
   # Output the go versions we are going to test
     - gvm use stable && go version
 
+  # CLEAN
+    - gvm use stable && make clean:
+        pwd: $BASE_STABLE
+
   # FMT
     - gvm use stable && make fmt:
         pwd: $BASE_STABLE
@@ -59,11 +63,17 @@ test:
 
   override:
   # Test stable, and report
-    - gvm use stable && make ci:
+  # hacking this to be parallel
+    - case $CIRCLE_NODE_INDEX in 0) gvm use stable && NOTARY_BUILDTAGS=pkcs11 make ci ;; 1) gvm use stable && NOTARY_BUILDTAGS=none make ci ;; esac:
+        parallel: true
         timeout: 600
         pwd: $BASE_STABLE
 
   post:
+    - gvm use stable && make covmerge:
+        timeout: 600
+        pwd: $BASE_STABLE
+
   # Report to codecov.io
     # - bash <(curl -s https://codecov.io/bash):
     #     pwd: $BASE_STABLE
diff --git a/client/repo.go b/client/repo.go
index 43f4ed78ce..d289d7ab68 100644
--- a/client/repo.go
+++ b/client/repo.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"path/filepath"
 
-	"github.com/docker/notary"
 	"github.com/docker/notary/cryptoservice"
 	"github.com/docker/notary/keystoremanager"
 	"github.com/docker/notary/passphrase"
@@ -22,7 +21,7 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
 	retriever passphrase.Retriever) (*NotaryRepository, error) {
 	fileKeyStore, err := trustmanager.NewKeyFileStore(baseDir, retriever)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create private key store in directory: %s", keysPath)
+		return nil, fmt.Errorf("failed to create private key store in directory: %s", baseDir)
 	}
 
 	keyStoreManager, err := keystoremanager.NewKeyStoreManager(baseDir, fileKeyStore)

From 7108450a21578e435c6e0912e9d998bcf937dddb Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Mon, 9 Nov 2015 19:32:55 -0800
Subject: [PATCH 72/85] Add more unit tests for the YubiKeyStore.

Including how it interacts with the backup key store, and with more
assertions against a new YubiKeyStore so that we won't get false
positives or negatives from the cache.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore_test.go | 355 ++++++++++++++++++----
 1 file changed, 300 insertions(+), 55 deletions(-)

diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 9d7863d62b..a5c10a0375 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -3,6 +3,7 @@
 package yubikey
 
 import (
+	"bytes"
 	"crypto/rand"
 	"reflect"
 	"testing"
@@ -13,11 +14,11 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+var ret = passphrase.ConstantRetriever("passphrase")
+
+// create a new store for clearing out keys, because we don't want to pollute
+// any cache
 func clearAllKeys(t *testing.T) {
-	// TODO(cyli): this is creating a new yubikey store because for some reason,
-	// removing and then adding with the same YubiKeyStore causes
-	// non-deterministic failures at least on Mac OS
-	ret := passphrase.ConstantRetriever("passphrase")
 	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 
@@ -53,7 +54,7 @@ func TestEnsurePrivateKeySizePadsLessThanRequiredSizeArrays(t *testing.T) {
 	assert.True(t, reflect.DeepEqual(expected, result))
 }
 
-func testAddKey(t *testing.T, store *YubiKeyStore) (data.PrivateKey, error) {
+func testAddKey(t *testing.T, store trustmanager.KeyStore) (data.PrivateKey, error) {
 	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err)
 
@@ -61,68 +62,207 @@ func testAddKey(t *testing.T, store *YubiKeyStore) (data.PrivateKey, error) {
 	return privKey, err
 }
 
-func TestAddKeyToNextEmptyYubikeySlot(t *testing.T) {
-	if !YubikeyAccessible() {
-		t.Skip("Must have Yubikey access.")
-	}
-	clearAllKeys(t)
-
-	ret := passphrase.ConstantRetriever("passphrase")
-	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
-	assert.NoError(t, err)
-	SetYubikeyKeyMode(KeymodeNone)
-	defer func() {
-		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
-	}()
-
+func addMaxKeys(t *testing.T, store trustmanager.KeyStore) []string {
 	keys := make([]string, 0, numSlots)
-
 	// create the maximum number of keys
 	for i := 0; i < numSlots; i++ {
 		privKey, err := testAddKey(t, store)
 		assert.NoError(t, err)
 		keys = append(keys, privKey.ID())
 	}
-
-	// create a new store, to make sure we're not just using the keys cache
-	store, err = NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
-	assert.NoError(t, err)
-	listedKeys := store.ListKeys()
-	assert.Len(t, listedKeys, numSlots)
-	for _, k := range keys {
-		r, ok := listedKeys[k]
-		assert.True(t, ok)
-		assert.Equal(t, data.CanonicalRootRole, r)
-	}
-
-	// add another key - should fail because there are no more slots
-	_, err = testAddKey(t, store)
-	assert.Error(t, err)
-
-	// delete one of the middle keys, and assert we can still create a new key
-	err = store.RemoveKey(keys[numSlots/2])
-	assert.NoError(t, err)
-
-	_, err = testAddKey(t, store)
-	assert.NoError(t, err)
+	return keys
 }
 
-// ImportKey imports a key as root without adding it to the backup store
-func TestImportKey(t *testing.T) {
+// We can add keys enough times to fill up all the slots in the Yubikey.
+// They are backed up, and we can then list them and get the keys.
+func TestYubiAddKeysAndRetrieve(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
 	}
 	clearAllKeys(t)
 
-	ret := passphrase.ConstantRetriever("passphrase")
-	backup := trustmanager.NewKeyMemoryStore(ret)
-	store, err := NewYubiKeyStore(backup, ret)
-	assert.NoError(t, err)
 	SetYubikeyKeyMode(KeymodeNone)
 	defer func() {
 		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
 	}()
 
+	// create 4 keys on the original store
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+	keys := addMaxKeys(t, origStore)
+
+	// create a new store, since we want to be sure the original store's cache
+	// is not masking any issues
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	// All 4 keys should be in the original store, in the clean store (which
+	// makes sure the keys are actually on the Yubikey and not on the original
+	// store's cache, and on the backup store)
+	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+		listedKeys := store.ListKeys()
+		assert.Len(t, listedKeys, numSlots)
+		for _, k := range keys {
+			r, ok := listedKeys[k]
+			assert.True(t, ok)
+			assert.Equal(t, data.CanonicalRootRole, r)
+
+			_, _, err := store.GetKey(k)
+			assert.NoError(t, err)
+		}
+	}
+}
+
+// We can't add a key if there are no more slots
+func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	// create 4 keys on the original store
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+	addMaxKeys(t, origStore)
+
+	// add another key - should fail because there are no more slots
+	badKey, err := testAddKey(t, origStore)
+	assert.Error(t, err)
+
+	// create a new store, since we want to be sure the original store's cache
+	// is not masking any issues
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	// The key should not be in the original store, in the new clean store, or
+	// in teh backup store.
+	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+		// the key that wasn't created should not appear in ListKeys or GetKey
+		_, _, err := store.GetKey(badKey.ID())
+		assert.Error(t, err)
+		for k := range store.ListKeys() {
+			assert.NotEqual(t, badKey, k)
+		}
+	}
+}
+
+// If some random key in the middle was removed, adding a key will work (keys
+// do not have to be deleted/added in order)
+func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	// create 4 keys on the original store
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+	keys := addMaxKeys(t, origStore)
+
+	// delete one of the middle keys, and assert we can still create a new key
+	keyIDToDelete := keys[numSlots/2]
+	err = origStore.RemoveKey(keyIDToDelete)
+	assert.NoError(t, err)
+
+	newKey, err := testAddKey(t, origStore)
+	assert.NoError(t, err)
+
+	// create a new store, since we want to be sure the original store's cache
+	// is not masking any issues
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	// The new key should be in the original store, in the new clean store, and
+	// in the backup store.  The old key should not be in the original store,
+	// or the new clean store.
+	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+		// new key should appear in all stores
+		gottenKey, _, err := store.GetKey(newKey.ID())
+		assert.NoError(t, err)
+		assert.Equal(t, gottenKey.ID(), newKey.ID())
+
+		listedKeys := store.ListKeys()
+		_, ok := listedKeys[newKey.ID()]
+		assert.True(t, ok)
+
+		// old key should not be in the non-backup stores
+		if store != backup {
+			_, _, err := store.GetKey(keyIDToDelete)
+			assert.Error(t, err)
+			_, ok = listedKeys[keyIDToDelete]
+			assert.False(t, ok)
+		}
+	}
+}
+
+// RemoveKey removes a key from the yubikey, but not from the backup store.
+func TestYubiRemoveKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
+	key, err := testAddKey(t, origStore)
+	assert.NoError(t, err)
+	err = origStore.RemoveKey(key.ID())
+	assert.NoError(t, err)
+
+	// key remains in the backup store
+	backupKey, role, err := backup.GetKey(key.ID())
+	assert.NoError(t, err)
+	assert.Equal(t, data.CanonicalRootRole, role)
+	assert.Equal(t, key.ID(), backupKey.ID())
+
+	// create a new store, since we want to be sure the original store's cache
+	// is not masking any issues
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	// key is not in either the original store or the clean store
+	for _, store := range []*YubiKeyStore{origStore, cleanStore} {
+		_, _, err := store.GetKey(key.ID())
+		assert.Error(t, err)
+	}
+}
+
+// ImportKey imports a key as root without adding it to the backup store
+func TestYubiImportKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
 	// generate key and import it
 	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
 	assert.NoError(t, err)
@@ -130,18 +270,123 @@ func TestImportKey(t *testing.T) {
 	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
-	err = store.ImportKey(pemBytes, "root")
+	err = origStore.ImportKey(pemBytes, "root")
 	assert.NoError(t, err)
 
 	// key is not in backup store
 	_, _, err = backup.GetKey(privKey.ID())
 	assert.Error(t, err)
 
-	// ensure key is in Yubikey -  create a new store, to make sure we're not
-	// just using the keys cache
-	store, err = NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
-	gottenKey, role, err := store.GetKey(privKey.ID())
+	// create a new store, since we want to be sure the original store's cache
+	// is not masking any issues
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	for _, store := range []*YubiKeyStore{origStore, cleanStore} {
+		gottenKey, role, err := store.GetKey(privKey.ID())
+		assert.NoError(t, err)
+		assert.Equal(t, data.CanonicalRootRole, role)
+		assert.Equal(t, privKey.Public(), gottenKey.Public())
+	}
+}
+
+// One cannot export from hardware - it will not export from the backup
+func TestYubiExportKeyFails(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	key, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	_, err = store.ExportKey(key.ID())
+	assert.Error(t, err)
+}
+
+// If there are keys in the backup store but no keys in the Yubikey,
+// listing and getting cannot access the keys in the backup store
+func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	key, err := testAddKey(t, backup)
+	assert.NoError(t, err)
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.Len(t, store.ListKeys(), 0)
+	_, _, err = store.GetKey(key.ID())
+	assert.Error(t, err)
+}
+
+// Get a YubiPrivateKey.  Check that it has the right algorithm, etc, and
+// specifically that you cannot get the private bytes out.
+func TestYubiKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	ecdsaPrivateKey, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	yubiPrivateKey, _, err := store.GetKey(ecdsaPrivateKey.ID())
+	assert.NoError(t, err)
+
+	assert.Equal(t, data.ECDSAKey, yubiPrivateKey.Algorithm())
+	assert.Equal(t, data.ECDSASignature, yubiPrivateKey.SignatureAlgorithm())
+	assert.Equal(t, ecdsaPrivateKey.Public(), yubiPrivateKey.Public())
+	assert.Nil(t, yubiPrivateKey.Private())
+}
+
+// Get a YubiPrivateKey.  Sign something with it.
+func TestYubiSigning(t *testing.T) {
+	// TODO(cyli): the signature should be verified, but the importing the
+	// verifiers causes an import cycle.  A bigger refactor needs to be done
+	// to fix it.
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	ecdsaPrivateKey, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	yubiPrivateKey, _, err := store.GetKey(ecdsaPrivateKey.ID())
+	assert.NoError(t, err)
+
+	msg := []byte("Hello there")
+	_, err = yubiPrivateKey.Sign(bytes.NewBuffer(msg), msg, nil)
 	assert.NoError(t, err)
-	assert.Equal(t, data.CanonicalRootRole, role)
-	assert.Equal(t, privKey.Public(), gottenKey.Public())
 }

From 09c0f9d05bbf3752f6515036309450ca5705e074 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Tue, 10 Nov 2015 00:53:11 -0800
Subject: [PATCH 73/85] Replace the pkcs11 library with interfaces for easier
 testing.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/pkcs11_interface.go | 40 +++++++++++++++++++
 trustmanager/yubikey/yubikeystore.go     | 50 ++++++++++++++++--------
 2 files changed, 73 insertions(+), 17 deletions(-)
 create mode 100644 trustmanager/yubikey/pkcs11_interface.go

diff --git a/trustmanager/yubikey/pkcs11_interface.go b/trustmanager/yubikey/pkcs11_interface.go
new file mode 100644
index 0000000000..4a46e05f0c
--- /dev/null
+++ b/trustmanager/yubikey/pkcs11_interface.go
@@ -0,0 +1,40 @@
+// +build pkcs11
+
+// an interface around the pkcs11 library, so that things can be mocked out
+// for testing
+
+package yubikey
+
+import "github.com/miekg/pkcs11"
+
+// IPKCS11 is an interface for wrapping github.com/miekg/pkcs11
+type pkcs11LibLoader func(module string) IPKCS11Ctx
+
+func defaultLoader(module string) IPKCS11Ctx {
+	return pkcs11.New(module)
+}
+
+// IPKCS11Ctx is an interface for wrapping the parts of
+// github.com/miekg/pkcs11.Ctx that yubikeystore requires
+type IPKCS11Ctx interface {
+	Destroy()
+	Initialize() error
+	Finalize() error
+	GetSlotList(tokenPresent bool) ([]uint, error)
+	OpenSession(slotID uint, flags uint) (pkcs11.SessionHandle, error)
+	CloseSession(sh pkcs11.SessionHandle) error
+	Login(sh pkcs11.SessionHandle, userType uint, pin string) error
+	Logout(sh pkcs11.SessionHandle) error
+	CreateObject(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) (
+		pkcs11.ObjectHandle, error)
+	DestroyObject(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) error
+	GetAttributeValue(sh pkcs11.SessionHandle, o pkcs11.ObjectHandle,
+		a []*pkcs11.Attribute) ([]*pkcs11.Attribute, error)
+	FindObjectsInit(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) error
+	FindObjects(sh pkcs11.SessionHandle, max int) (
+		[]pkcs11.ObjectHandle, bool, error)
+	FindObjectsFinal(sh pkcs11.SessionHandle) error
+	SignInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism,
+		o pkcs11.ObjectHandle) error
+	Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error)
+}
diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index c3e55da0b7..fae3be6659 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -112,17 +112,21 @@ type YubiPrivateKey struct {
 	data.ECDSAPublicKey
 	passRetriever passphrase.Retriever
 	slot          []byte
+	libLoader     pkcs11LibLoader
 }
 
 type YubikeySigner struct {
 	YubiPrivateKey
 }
 
-func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey, passRetriever passphrase.Retriever) *YubiPrivateKey {
+func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey,
+	passRetriever passphrase.Retriever) *YubiPrivateKey {
+
 	return &YubiPrivateKey{
 		ECDSAPublicKey: pubKey,
 		passRetriever:  passRetriever,
 		slot:           slot,
+		libLoader:      defaultLoader,
 	}
 }
 
@@ -135,6 +139,10 @@ func (ys *YubikeySigner) Public() crypto.PublicKey {
 	return publicKey
 }
 
+func (y *YubiPrivateKey) setLibLoader(loader pkcs11LibLoader) {
+	y.libLoader = loader
+}
+
 // CryptoSigner returns a crypto.Signer tha wraps the YubiPrivateKey. Needed for
 // Certificate generation only
 func (y *YubiPrivateKey) CryptoSigner() crypto.Signer {
@@ -153,7 +161,7 @@ func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm {
 }
 
 func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, y.libLoader)
 	if err != nil {
 		return nil, err
 	}
@@ -186,7 +194,7 @@ func ensurePrivateKeySize(payload []byte) []byte {
 
 // addECDSAKey adds a key to the yubikey
 func addECDSAKey(
-	ctx *pkcs11.Ctx,
+	ctx IPKCS11Ctx,
 	session pkcs11.SessionHandle,
 	privKey data.PrivateKey,
 	pkcs11KeyID []byte,
@@ -255,7 +263,7 @@ func addECDSAKey(
 	return nil
 }
 
-func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte) (*data.ECDSAPublicKey, string, error) {
+func getECDSAKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte) (*data.ECDSAPublicKey, string, error) {
 	findTemplate := []*pkcs11.Attribute{
 		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
 		pkcs11.NewAttribute(pkcs11.CKA_ID, pkcs11KeyID),
@@ -313,7 +321,7 @@ func getECDSAKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []by
 }
 
 // Sign returns a signature for a given signature request
-func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) {
+func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) {
 	err := login(ctx, session, passRetriever, pkcs11.CKU_USER, USER_PIN)
 	if err != nil {
 		return nil, fmt.Errorf("error logging in: %v", err)
@@ -367,7 +375,7 @@ func sign(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pas
 	return sig[:], nil
 }
 
-func yubiRemoveKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
+func yubiRemoveKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
 	err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN)
 	if err != nil {
 		return err
@@ -408,7 +416,7 @@ func yubiRemoveKey(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, pkcs11KeyID []
 	return nil
 }
 
-func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[string]yubiSlot, err error) {
+func yubiListKeys(ctx IPKCS11Ctx, session pkcs11.SessionHandle) (keys map[string]yubiSlot, err error) {
 	keys = make(map[string]yubiSlot)
 	findTemplate := []*pkcs11.Attribute{
 		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
@@ -501,7 +509,7 @@ func yubiListKeys(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) (keys map[strin
 	return
 }
 
-func getNextEmptySlot(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) ([]byte, error) {
+func getNextEmptySlot(ctx IPKCS11Ctx, session pkcs11.SessionHandle) ([]byte, error) {
 	findTemplate := []*pkcs11.Attribute{
 		pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
 	}
@@ -571,6 +579,7 @@ type YubiKeyStore struct {
 	passRetriever passphrase.Retriever
 	keys          map[string]yubiSlot
 	backupStore   trustmanager.KeyStore
+	libLoader     pkcs11LibLoader
 }
 
 // NewYubiKeyStore returns a YubiKeyStore, given a backup key store to write any
@@ -582,6 +591,7 @@ func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever pass
 		passRetriever: passphraseRetriever,
 		keys:          make(map[string]yubiSlot),
 		backupStore:   backupStore,
+		libLoader:     defaultLoader,
 	}
 	s.ListKeys() // populate keys field
 	return s, nil
@@ -593,11 +603,15 @@ func (s YubiKeyStore) Name() string {
 	return "yubikey"
 }
 
+func (s *YubiKeyStore) setLibLoader(loader pkcs11LibLoader) {
+	s.libLoader = loader
+}
+
 func (s *YubiKeyStore) ListKeys() map[string]string {
 	if len(s.keys) > 0 {
 		return buildKeyMap(s.keys)
 	}
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
@@ -625,7 +639,7 @@ func (s *YubiKeyStore) addKey(
 		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s", role, keyID)
 	}
 
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return err
@@ -668,7 +682,7 @@ func (s *YubiKeyStore) addKey(
 // GetKey retrieves a key from the Yubikey only (it does not look inside the
 // backup store)
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil, "", err
@@ -700,7 +714,7 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 // RemoveKey deletes a key from the Yubikey only (it does not remove it from the
 // backup store)
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
@@ -741,18 +755,20 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 	return s.addKey(privKey.ID(), "root", privKey, false)
 }
 
-func cleanup(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
+func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
 	ctx.CloseSession(session)
 	ctx.Finalize()
 	ctx.Destroy()
 }
 
 // SetupHSMEnv is a method that depends on the existences
-func SetupHSMEnv(libraryPath string) (*pkcs11.Ctx, pkcs11.SessionHandle, error) {
+func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
+	IPKCS11Ctx, pkcs11.SessionHandle, error) {
+
 	if libraryPath == "" {
 		return nil, 0, errors.New("No library found.")
 	}
-	p := pkcs11.New(libraryPath)
+	p := libLoader(libraryPath)
 
 	if p == nil {
 		return nil, 0, errors.New("Failed to init library")
@@ -786,7 +802,7 @@ func YubikeyAccessible() bool {
 	if pkcs11Lib == "" {
 		return false
 	}
-	ctx, session, err := SetupHSMEnv(pkcs11Lib)
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, defaultLoader)
 	if err != nil {
 		return false
 	}
@@ -794,7 +810,7 @@ func YubikeyAccessible() bool {
 	return true
 }
 
-func login(ctx *pkcs11.Ctx, session pkcs11.SessionHandle, passRetriever passphrase.Retriever, userFlag uint, defaultPassw string) error {
+func login(ctx IPKCS11Ctx, session pkcs11.SessionHandle, passRetriever passphrase.Retriever, userFlag uint, defaultPassw string) error {
 	// try default password
 	err := ctx.Login(session, userFlag, defaultPassw)
 	if err == nil {

From 73a26d59ac6d5e59ac9a4204de0b2b01f8941d55 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 11:31:35 -0800
Subject: [PATCH 74/85] Inject errors into pkcs11 in order to test that the
 yubikey code cleans up.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore.go      |  34 +-
 trustmanager/yubikey/yubikeystore_test.go | 594 +++++++++++++++++++++-
 2 files changed, 603 insertions(+), 25 deletions(-)

diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index fae3be6659..f1528292f3 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -162,10 +162,10 @@ func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm {
 
 func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, y.libLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		return nil, err
 	}
-	defer cleanup(ctx, session)
 
 	v := signed.Verifiers[data.ECDSASignature]
 	for i := 0; i < sigAttempts; i++ {
@@ -294,7 +294,7 @@ func getECDSAKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byt
 		return nil, "", errors.New("no matching keys found inside of yubikey")
 	}
 
-	// Retrieve the public-key material to be able to create a new HSMRSAKey
+	// Retrieve the public-key material to be able to create a new ECSAKey
 	attr, err := ctx.GetAttributeValue(session, obj[0], attrTemplate)
 	if err != nil {
 		logrus.Debugf("Failed to get Attribute for: %v", obj[0])
@@ -464,7 +464,7 @@ func yubiListKeys(ctx IPKCS11Ctx, session pkcs11.SessionHandle) (keys map[string
 			cert *x509.Certificate
 			slot []byte
 		)
-		// Retrieve the public-key material to be able to create a new HSMRSAKey
+		// Retrieve the public-key material to be able to create a new ECDSA
 		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
 		if err != nil {
 			logrus.Debugf("Failed to get Attribute for: %v", obj)
@@ -612,11 +612,11 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 		return buildKeyMap(s.keys)
 	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
-	defer cleanup(ctx, session)
 	keys, err := yubiListKeys(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to list key from the yubikey: %s", err.Error())
@@ -640,11 +640,11 @@ func (s *YubiKeyStore) addKey(
 	}
 
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return err
 	}
-	defer cleanup(ctx, session)
 
 	if k, ok := s.keys[keyID]; ok {
 		if k.role == role {
@@ -683,11 +683,11 @@ func (s *YubiKeyStore) addKey(
 // backup store)
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil, "", err
 	}
-	defer cleanup(ctx, session)
 
 	key, ok := s.keys[keyID]
 	if !ok {
@@ -715,11 +715,11 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 // backup store)
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
-	defer cleanup(ctx, session)
 	key, ok := s.keys[keyID]
 	if !ok {
 		return errors.New("Key not present in yubikey")
@@ -756,9 +756,17 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 }
 
 func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
-	ctx.CloseSession(session)
-	ctx.Finalize()
-	ctx.Destroy()
+	if ctx != nil {
+		err := ctx.CloseSession(session)
+		if err != nil {
+			logrus.Debugf("Error closing session: %s", err.Error())
+		}
+		err = ctx.Finalize()
+		if err != nil {
+			logrus.Debugf("Error finalizing: %s", err.Error())
+		}
+		ctx.Destroy()
+	}
 }
 
 // SetupHSMEnv is a method that depends on the existences
@@ -775,15 +783,18 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
 	}
 
 	if err := p.Initialize(); err != nil {
+		defer cleanup(p, 0)
 		return nil, 0, fmt.Errorf("Initialize error %s", err.Error())
 	}
 
 	slots, err := p.GetSlotList(true)
 	if err != nil {
+		defer cleanup(p, 0)
 		return nil, 0, fmt.Errorf("Failed to list HSM slots %s", err)
 	}
 	// Check to see if we got any slots from the HSM.
 	if len(slots) < 1 {
+		defer cleanup(p, 0)
 		return nil, 0, fmt.Errorf("No HSM Slots found")
 	}
 
@@ -791,6 +802,7 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
 	// CKF_RW_SESSION: TRUE if the session is read/write; FALSE if the session is read-only
 	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
 	if err != nil {
+		defer cleanup(p, 0)
 		return nil, 0, fmt.Errorf("Failed to Start Session with HSM %s", err)
 	}
 
@@ -803,10 +815,10 @@ func YubikeyAccessible() bool {
 		return false
 	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, defaultLoader)
+	defer cleanup(ctx, session)
 	if err != nil {
 		return false
 	}
-	defer cleanup(ctx, session)
 	return true
 }
 
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index a5c10a0375..2451dc3d08 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -3,14 +3,15 @@
 package yubikey
 
 import (
-	"bytes"
 	"crypto/rand"
+	"fmt"
 	"reflect"
 	"testing"
 
 	"github.com/docker/notary/passphrase"
 	"github.com/docker/notary/trustmanager"
 	"github.com/docker/notary/tuf/data"
+	"github.com/miekg/pkcs11"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -248,7 +249,7 @@ func TestYubiRemoveKey(t *testing.T) {
 }
 
 // ImportKey imports a key as root without adding it to the backup store
-func TestYubiImportKey(t *testing.T) {
+func TestYubiImportNewKey(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
 	}
@@ -289,6 +290,74 @@ func TestYubiImportKey(t *testing.T) {
 	}
 }
 
+// Importing an existing key succeeds, but doesn't actually add the key, nor
+// does it write it to backup.
+func TestYubiImportExistingKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	key, err := testAddKey(t, origStore)
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	newStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
+	// for sanity, ensure that the key is already in the Yubikey
+	k, _, err := newStore.GetKey(key.ID())
+	assert.NoError(t, err)
+	assert.NotNil(t, k)
+
+	// import the key, which should have already been added to the yubikey
+	pemBytes, err := trustmanager.EncryptPrivateKey(key, "passphrase")
+	assert.NoError(t, err)
+	err = newStore.ImportKey(pemBytes, "root")
+	assert.NoError(t, err)
+
+	// key is not in backup store
+	_, _, err = backup.GetKey(key.ID())
+	assert.Error(t, err)
+}
+
+// Importing a key not as root fails, and it is not added to the backup store
+func TestYubiImportNonRootKey(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
+	// generate key and import it
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err)
+
+	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
+	assert.NoError(t, err)
+
+	err = origStore.ImportKey(pemBytes, privKey.ID())
+	assert.Error(t, err)
+
+	// key is not in backup store
+	_, _, err = backup.GetKey(privKey.ID())
+	assert.Error(t, err)
+}
+
 // One cannot export from hardware - it will not export from the backup
 func TestYubiExportKeyFails(t *testing.T) {
 	if !YubikeyAccessible() {
@@ -335,8 +404,9 @@ func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) {
 }
 
 // Get a YubiPrivateKey.  Check that it has the right algorithm, etc, and
-// specifically that you cannot get the private bytes out.
-func TestYubiKey(t *testing.T) {
+// specifically that you cannot get the private bytes out.  Assume we can
+// sign something.
+func TestYubiKeyAndSign(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
 	}
@@ -360,13 +430,319 @@ func TestYubiKey(t *testing.T) {
 	assert.Equal(t, data.ECDSASignature, yubiPrivateKey.SignatureAlgorithm())
 	assert.Equal(t, ecdsaPrivateKey.Public(), yubiPrivateKey.Public())
 	assert.Nil(t, yubiPrivateKey.Private())
+
+	// The signature should be verified, but the importing the verifiers causes
+	// an import cycle.  A bigger refactor needs to be done to fix it.
+	msg := []byte("Hello there")
+	_, err = yubiPrivateKey.Sign(rand.Reader, msg, nil)
+	assert.NoError(t, err)
 }
 
-// Get a YubiPrivateKey.  Sign something with it.
-func TestYubiSigning(t *testing.T) {
-	// TODO(cyli): the signature should be verified, but the importing the
-	// verifiers causes an import cycle.  A bigger refactor needs to be done
-	// to fix it.
+// ----- Negative tests that use stubbed pkcs11 for error injection -----
+
+type pkcs11Stubbable interface {
+	setLibLoader(pkcs11LibLoader)
+}
+
+var setupErrors = []string{"Initialize", "GetSlotList", "OpenSession"}
+
+// Create a new store, so that we avoid any cache issues, and list keys
+func cleanListKeys(t *testing.T) map[string]string {
+	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	return cleanStore.ListKeys()
+}
+
+// If an error occurs during login, which only some functions do, the function
+// under test will clean up after itself
+func testYubiFunctionCleansUpOnLoginError(t *testing.T, toStub pkcs11Stubbable,
+	functionUnderTest func() error) {
+
+	toStub.setLibLoader(func(string) IPKCS11Ctx {
+		return NewStubCtx(map[string]bool{"Login": true})
+	})
+
+	err := functionUnderTest()
+	assert.Error(t, err)
+	// a lot of these functions wrap other errors
+	assert.Contains(t, err.Error(), trustmanager.ErrAttemptsExceeded{}.Error())
+
+	// Set Up another time, to ensure we weren't left in a bad state
+	// by the previous runs
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, defaultLoader)
+	assert.NoError(t, err)
+	cleanup(ctx, session)
+}
+
+// If one of the specified pkcs11 functions errors, the function under test
+// will clean up after itself
+func testYubiFunctionCleansUpOnSpecifiedErrors(t *testing.T,
+	toStub pkcs11Stubbable, functionUnderTest func() error,
+	dependentFunctions []string, functionShouldError bool) {
+
+	for _, methodName := range dependentFunctions {
+
+		toStub.setLibLoader(func(string) IPKCS11Ctx {
+			return NewStubCtx(
+				map[string]bool{methodName: true})
+		})
+
+		err := functionUnderTest()
+		if functionShouldError {
+			assert.Error(t, err,
+				fmt.Sprintf("Didn't error when %s errored.", methodName))
+			// a lot of these functions wrap other errors
+			assert.Contains(t, err.Error(), errInjected{methodName}.Error())
+		} else {
+			assert.NoError(t, err)
+		}
+	}
+
+	// Set Up another time, to ensure we weren't left in a bad state
+	// by the previous runs
+	ctx, session, err := SetupHSMEnv(pkcs11Lib, defaultLoader)
+	assert.NoError(t, err)
+	cleanup(ctx, session)
+}
+
+func TestYubiAddKeyCleansUpOnError(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	origStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
+	var _addkey = func() error {
+		_, err := testAddKey(t, origStore)
+		return err
+	}
+
+	testYubiFunctionCleansUpOnLoginError(t, origStore, _addkey)
+	// all the PKCS11 functions AddKey depends on that aren't the login/logout
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+		append(
+			setupErrors,
+			"FindObjectsInit",
+			"FindObjects",
+			"CreateObject",
+		), true)
+
+	// given that everything should have errored, there should be no keys on
+	// the yubikey and no keys in backup
+	assert.Len(t, backup.ListKeys(), 0)
+	assert.Len(t, cleanListKeys(t), 0)
+
+	// Logout should not cause a function failure - it s a cleanup failure,
+	// which shouldn't break anything, and it should clean up after itself.
+	// The key should be added to both stores
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+		[]string{"Logout"}, false)
+
+	listedKeys := cleanListKeys(t)
+	assert.Len(t, backup.ListKeys(), 1)
+	assert.Len(t, listedKeys, 1)
+
+	// Currently, if GetAttributeValue fails, the function succeeds, because if
+	// we can't get the attribute value of an object, we don't know what slot
+	// it's in, we assume its occupied slot is free (hence this failure will
+	// cause the previous key to be overwritten).  This behavior may need to
+	// be revisited.
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+		[]string{"GetAttributeValue"}, false)
+
+	newListedKeys := cleanListKeys(t)
+	// because the original key got overwritten
+	assert.Len(t, backup.ListKeys(), 2)
+	assert.Len(t, newListedKeys, 1)
+	for k := range newListedKeys {
+		_, ok := listedKeys[k]
+		assert.False(t, ok)
+	}
+}
+
+func TestYubiGetKeyCleansUpOnError(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	key, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	var _getkey = func() error {
+		_, _, err := store.GetKey(key.ID())
+		return err
+	}
+
+	// all the PKCS11 functions GetKey depends on
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _getkey,
+		append(
+			setupErrors,
+			"FindObjectsInit",
+			"FindObjects",
+			"FindObjectsFinal",
+			"GetAttributeValue",
+		), true)
+}
+
+func TestYubiImportKeyCleansUpOnError(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err)
+
+	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
+	assert.NoError(t, err)
+
+	var _importkey = func() error { return origStore.ImportKey(pemBytes, "root") }
+
+	testYubiFunctionCleansUpOnLoginError(t, origStore, _importkey)
+	// all the PKCS11 functions ImportKey depends on that aren't the login/logout
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+		append(
+			setupErrors,
+			"FindObjectsInit",
+			"FindObjects",
+			"CreateObject",
+		), true)
+
+	// given that everything should have errored, there should be no keys on
+	// the yubikey
+	assert.Len(t, cleanListKeys(t), 0)
+
+	// Logout should not cause a function failure - it s a cleanup failure,
+	// which shouldn't break anything, and it should clean up after itself.
+	// The key should be added to both stores
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+		[]string{"Logout"}, false)
+
+	listedKeys := cleanListKeys(t)
+	assert.Len(t, listedKeys, 1)
+
+	// Currently, if GetAttributeValue fails, the function succeeds, because if
+	// we can't get the attribute value of an object, we don't know what slot
+	// it's in, we assume its occupied slot is free (hence this failure will
+	// cause the previous key to be overwritten).  This behavior may need to
+	// be revisited.
+	for k := range listedKeys {
+		err := origStore.RemoveKey(k)
+		assert.NoError(t, err)
+	}
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+		[]string{"GetAttributeValue"}, false)
+
+	assert.Len(t, cleanListKeys(t), 1)
+}
+
+func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+	key, err := testAddKey(t, origStore)
+	assert.NoError(t, err)
+
+	var _removekey = func() error { return origStore.RemoveKey(key.ID()) }
+
+	testYubiFunctionCleansUpOnLoginError(t, origStore, _removekey)
+	// RemoveKey just succeeds if we can't set up the yubikey
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey, setupErrors, false)
+	// all the PKCS11 functions RemoveKey depends on that aren't the login/logout
+	// or setup/cleanup
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey,
+		[]string{
+			"FindObjectsInit",
+			"FindObjects",
+			"FindObjectsFinal",
+			"DestroyObject",
+		}, true)
+
+	// given that everything should have errored, there should still be 1 key
+	// on the yubikey
+	assert.Len(t, cleanListKeys(t), 1)
+
+	// this will not fail, but it should clean up after itself, and the key
+	// should be added to both stores
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey,
+		[]string{"Logout"}, false)
+
+	assert.Len(t, cleanListKeys(t), 0)
+}
+
+func TestYubiListKeyCleansUpOnError(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	// Do not call NewYubiKeyStore, because it list keys immediately to
+	// build the cache.
+	store := &YubiKeyStore{
+		passRetriever: ret,
+		keys:          make(map[string]yubiSlot),
+		backupStore:   trustmanager.NewKeyMemoryStore(ret),
+		libLoader:     defaultLoader,
+	}
+
+	var _listkeys = func() error {
+		// ListKeys never fails
+		store.ListKeys()
+		return nil
+	}
+
+	// all the PKCS11 functions ListKey depends on - list keys never errors
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _listkeys,
+		append(
+			setupErrors,
+			"FindObjectsInit",
+			"FindObjects",
+			"FindObjectsFinal",
+			"GetAttributeValue",
+		), false)
+}
+
+// export key fails anyway, don't bother testing
+
+func TestYubiSignCleansUpOnError(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
 	}
@@ -380,13 +756,203 @@ func TestYubiSigning(t *testing.T) {
 	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 
-	ecdsaPrivateKey, err := testAddKey(t, store)
+	key, err := testAddKey(t, store)
 	assert.NoError(t, err)
 
-	yubiPrivateKey, _, err := store.GetKey(ecdsaPrivateKey.ID())
+	privKey, _, err := store.GetKey(key.ID())
 	assert.NoError(t, err)
 
-	msg := []byte("Hello there")
-	_, err = yubiPrivateKey.Sign(bytes.NewBuffer(msg), msg, nil)
-	assert.NoError(t, err)
+	yubiPrivateKey, ok := privKey.(*YubiPrivateKey)
+	assert.True(t, ok)
+
+	var _sign = func() error {
+		_, err = yubiPrivateKey.Sign(rand.Reader, []byte("Hello there"), nil)
+		return err
+	}
+
+	testYubiFunctionCleansUpOnLoginError(t, yubiPrivateKey, _sign)
+	// all the PKCS11 functions SignKey depends on that is not login/logout
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, yubiPrivateKey, _sign,
+		append(
+			setupErrors,
+			"FindObjectsInit",
+			"FindObjects",
+			"FindObjectsFinal",
+			"SignInit",
+			"Sign",
+		), true)
+	// this will not fail, but it should clean up after itself, and the key
+	// should be added to both stores
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, yubiPrivateKey, _sign,
+		[]string{"Logout"}, false)
+}
+
+// -----  Stubbed pkcs11 for testing error conditions ------
+// This is just a passthrough to the underlying pkcs11 library, with optional
+// error injection.  This is to ensure that if errors occur during the process
+// of interacting with the Yubikey, that everything gets cleaned up sanely.
+
+type errInjected struct {
+	methodName string
+}
+
+func (e errInjected) Error() string {
+	return fmt.Sprintf("Injected failure in %s", e.methodName)
+}
+
+const (
+	uninitialized = 0
+	initialized   = 1
+	sessioned     = 2
+	loggedin      = 3
+)
+
+type StubCtx struct {
+	ctx                IPKCS11Ctx
+	functionShouldFail map[string]bool
+}
+
+func NewStubCtx(functionShouldFail map[string]bool) *StubCtx {
+	realCtx := defaultLoader(pkcs11Lib)
+	return &StubCtx{
+		ctx:                realCtx,
+		functionShouldFail: functionShouldFail,
+	}
+}
+
+// Returns an error if we're supposed to error for this method
+func (s *StubCtx) checkErr(methodName string) error {
+	if val, ok := s.functionShouldFail[methodName]; ok && val {
+		return errInjected{methodName: methodName}
+	}
+	return nil
+}
+
+func (s *StubCtx) Destroy() {
+	// can't error
+	s.ctx.Destroy()
+}
+
+func (s *StubCtx) Initialize() error {
+	err := s.checkErr("Initialize")
+	if err != nil {
+		return err
+	}
+	return s.ctx.Initialize()
+}
+
+func (s *StubCtx) Finalize() error {
+	err := s.checkErr("Finalize")
+	if err != nil {
+		return err
+	}
+	return s.ctx.Finalize()
+}
+
+func (s *StubCtx) GetSlotList(tokenPresent bool) ([]uint, error) {
+	err := s.checkErr("GetSlotList")
+	if err != nil {
+		return nil, err
+	}
+	return s.ctx.GetSlotList(tokenPresent)
+}
+
+func (s *StubCtx) OpenSession(slotID uint, flags uint) (pkcs11.SessionHandle, error) {
+	err := s.checkErr("OpenSession")
+	if err != nil {
+		return pkcs11.SessionHandle(0), err
+	}
+	return s.ctx.OpenSession(slotID, flags)
+}
+
+func (s *StubCtx) CloseSession(sh pkcs11.SessionHandle) error {
+	err := s.checkErr("CloseSession")
+	if err != nil {
+		return err
+	}
+	return s.ctx.CloseSession(sh)
+}
+
+func (s *StubCtx) Login(sh pkcs11.SessionHandle, userType uint, pin string) error {
+	err := s.checkErr("Login")
+	if err != nil {
+		return err
+	}
+	return s.ctx.Login(sh, userType, pin)
+}
+
+func (s *StubCtx) Logout(sh pkcs11.SessionHandle) error {
+	err := s.checkErr("Logout")
+	if err != nil {
+		return err
+	}
+	return s.ctx.Logout(sh)
+}
+
+func (s *StubCtx) CreateObject(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) (
+	pkcs11.ObjectHandle, error) {
+	err := s.checkErr("CreateObject")
+	if err != nil {
+		return pkcs11.ObjectHandle(0), err
+	}
+	return s.ctx.CreateObject(sh, temp)
+}
+
+func (s *StubCtx) DestroyObject(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) error {
+	err := s.checkErr("DestroyObject")
+	if err != nil {
+		return err
+	}
+	return s.ctx.DestroyObject(sh, oh)
+}
+
+func (s *StubCtx) GetAttributeValue(sh pkcs11.SessionHandle, o pkcs11.ObjectHandle,
+	a []*pkcs11.Attribute) ([]*pkcs11.Attribute, error) {
+	err := s.checkErr("GetAttributeValue")
+	if err != nil {
+		return nil, err
+	}
+	return s.ctx.GetAttributeValue(sh, o, a)
+}
+
+func (s *StubCtx) FindObjectsInit(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) error {
+	err := s.checkErr("FindObjectsInit")
+	if err != nil {
+		return err
+	}
+	return s.ctx.FindObjectsInit(sh, temp)
+}
+
+func (s *StubCtx) FindObjects(sh pkcs11.SessionHandle, max int) (
+	[]pkcs11.ObjectHandle, bool, error) {
+	err := s.checkErr("FindObjects")
+	if err != nil {
+		return nil, false, err
+	}
+	return s.ctx.FindObjects(sh, max)
+}
+
+func (s *StubCtx) FindObjectsFinal(sh pkcs11.SessionHandle) error {
+	err := s.checkErr("FindObjectsFinal")
+	if err != nil {
+		return err
+	}
+	return s.ctx.FindObjectsFinal(sh)
+}
+
+func (s *StubCtx) SignInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism,
+	o pkcs11.ObjectHandle) error {
+	err := s.checkErr("SignInit")
+	if err != nil {
+		return err
+	}
+	return s.ctx.SignInit(sh, m, o)
+}
+
+func (s *StubCtx) Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error) {
+	err := s.checkErr("Sign")
+	if err != nil {
+		return nil, err
+	}
+	return s.ctx.Sign(sh, message)
 }

From 10057562d8f11259178169e159fdd4684538019f Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 16:28:23 -0800
Subject: [PATCH 75/85] Add fixes for Sign (do not continue if SignInit fails).

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore.go      | 7 ++++++-
 trustmanager/yubikey/yubikeystore_test.go | 9 ++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index f1528292f3..1f3a31e579 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -354,7 +354,11 @@ func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pass
 	}
 
 	var sig []byte
-	ctx.SignInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_ECDSA, nil)}, obj[0])
+	err = ctx.SignInit(
+		session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_ECDSA, nil)}, obj[0])
+	if err != nil {
+		return nil, err
+	}
 
 	// Get the SHA256 of the payload
 	digest := sha256.Sum256(payload)
@@ -363,6 +367,7 @@ func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pass
 		touchToSignUI()
 		defer touchDoneCallback()
 	}
+	// a call to Sign, whether or not Sign fails, will clear the SignInit
 	sig, err = ctx.Sign(session, digest[:])
 	if err != nil {
 		logrus.Debugf("Error while signing: %s", err)
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 2451dc3d08..70034561b0 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -792,6 +792,10 @@ func TestYubiSignCleansUpOnError(t *testing.T) {
 // error injection.  This is to ensure that if errors occur during the process
 // of interacting with the Yubikey, that everything gets cleaned up sanely.
 
+// Note that this does not actually replicate an actual PKCS11 failure, since
+// who knows what the pkcs11 function call may have done to the key before it
+// errored. This just tests that we handle an error ok.
+
 type errInjected struct {
 	methodName string
 }
@@ -950,9 +954,12 @@ func (s *StubCtx) SignInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism,
 }
 
 func (s *StubCtx) Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error) {
+	// a call to Sign will clear SignInit whether or not it fails, so
+	// replicate that by calling Sign, then optionally returning an error.
+	sig, sigErr := s.ctx.Sign(sh, message)
 	err := s.checkErr("Sign")
 	if err != nil {
 		return nil, err
 	}
-	return s.ctx.Sign(sh, message)
+	return sig, sigErr
 }

From 38a5b5a342cf7963bef1c9beac77179c63917c20 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 16:37:58 -0800
Subject: [PATCH 76/85] Add FindObjectsFinalize to getNextEmptySlot.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore.go      | 4 ++++
 trustmanager/yubikey/yubikeystore_test.go | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index 1f3a31e579..c7c54d03bd 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -545,6 +545,10 @@ func getNextEmptySlot(ctx IPKCS11Ctx, session pkcs11.SessionHandle) ([]byte, err
 		logrus.Debugf("Failed to find: %s %v", err.Error(), b)
 		return nil, err
 	}
+	if err = ctx.FindObjectsFinal(session); err != nil {
+		logrus.Debugf("Failed to finalize: %s\n", err.Error())
+		return nil, err
+	}
 	for _, obj := range objs {
 		// Retrieve the slot ID
 		attr, err := ctx.GetAttributeValue(session, obj, attrTemplate)
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 70034561b0..3cd151737b 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -532,6 +532,7 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
 			setupErrors,
 			"FindObjectsInit",
 			"FindObjects",
+			"FindObjectsFinal",
 			"CreateObject",
 		), true)
 
@@ -629,6 +630,7 @@ func TestYubiImportKeyCleansUpOnError(t *testing.T) {
 			setupErrors,
 			"FindObjectsInit",
 			"FindObjects",
+			"FindObjectsFinal",
 			"CreateObject",
 		), true)
 

From cee92fa36336071da217e0f224afc8f37af464a9 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 16:52:15 -0800
Subject: [PATCH 77/85] Undo some changes from a bad stash pop that were
 unintentional.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore.go      | 32 ++++-----
 trustmanager/yubikey/yubikeystore_test.go | 86 +++++++++++------------
 2 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index c7c54d03bd..47a97dc9bd 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -162,10 +162,10 @@ func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm {
 
 func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, y.libLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		return nil, err
 	}
+	defer cleanup(ctx, session)
 
 	v := signed.Verifiers[data.ECDSASignature]
 	for i := 0; i < sigAttempts; i++ {
@@ -621,11 +621,12 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 		return buildKeyMap(s.keys)
 	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
+	defer cleanup(ctx, session)
+
 	keys, err := yubiListKeys(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to list key from the yubikey: %s", err.Error())
@@ -649,11 +650,11 @@ func (s *YubiKeyStore) addKey(
 	}
 
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return err
 	}
+	defer cleanup(ctx, session)
 
 	if k, ok := s.keys[keyID]; ok {
 		if k.role == role {
@@ -692,11 +693,11 @@ func (s *YubiKeyStore) addKey(
 // backup store)
 func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil, "", err
 	}
+	defer cleanup(ctx, session)
 
 	key, ok := s.keys[keyID]
 	if !ok {
@@ -724,11 +725,12 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
 // backup store)
 func (s *YubiKeyStore) RemoveKey(keyID string) error {
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
 		return nil
 	}
+	defer cleanup(ctx, session)
+
 	key, ok := s.keys[keyID]
 	if !ok {
 		return errors.New("Key not present in yubikey")
@@ -765,17 +767,15 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 }
 
 func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
-	if ctx != nil {
-		err := ctx.CloseSession(session)
-		if err != nil {
-			logrus.Debugf("Error closing session: %s", err.Error())
-		}
-		err = ctx.Finalize()
-		if err != nil {
-			logrus.Debugf("Error finalizing: %s", err.Error())
-		}
-		ctx.Destroy()
+	err := ctx.CloseSession(session)
+	if err != nil {
+		logrus.Debugf("Error closing session: %s", err.Error())
 	}
+	err = ctx.Finalize()
+	if err != nil {
+		logrus.Debugf("Error finalizing: %s", err.Error())
+	}
+	ctx.Destroy()
 }
 
 // SetupHSMEnv is a method that depends on the existences
@@ -824,10 +824,10 @@ func YubikeyAccessible() bool {
 		return false
 	}
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, defaultLoader)
-	defer cleanup(ctx, session)
 	if err != nil {
 		return false
 	}
+	defer cleanup(ctx, session)
 	return true
 }
 
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 3cd151737b..ab53f2eaea 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -89,9 +89,9 @@ func TestYubiAddKeysAndRetrieve(t *testing.T) {
 
 	// create 4 keys on the original store
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
-	keys := addMaxKeys(t, origStore)
+	keys := addMaxKeys(t, store)
 
 	// create a new store, since we want to be sure the original store's cache
 	// is not masking any issues
@@ -101,7 +101,7 @@ func TestYubiAddKeysAndRetrieve(t *testing.T) {
 	// All 4 keys should be in the original store, in the clean store (which
 	// makes sure the keys are actually on the Yubikey and not on the original
 	// store's cache, and on the backup store)
-	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+	for _, store := range []trustmanager.KeyStore{store, cleanStore, backup} {
 		listedKeys := store.ListKeys()
 		assert.Len(t, listedKeys, numSlots)
 		for _, k := range keys {
@@ -129,12 +129,12 @@ func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
 
 	// create 4 keys on the original store
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
-	addMaxKeys(t, origStore)
+	addMaxKeys(t, store)
 
 	// add another key - should fail because there are no more slots
-	badKey, err := testAddKey(t, origStore)
+	badKey, err := testAddKey(t, store)
 	assert.Error(t, err)
 
 	// create a new store, since we want to be sure the original store's cache
@@ -144,7 +144,7 @@ func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
 
 	// The key should not be in the original store, in the new clean store, or
 	// in teh backup store.
-	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+	for _, store := range []trustmanager.KeyStore{store, cleanStore, backup} {
 		// the key that wasn't created should not appear in ListKeys or GetKey
 		_, _, err := store.GetKey(badKey.ID())
 		assert.Error(t, err)
@@ -169,16 +169,16 @@ func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
 
 	// create 4 keys on the original store
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
-	keys := addMaxKeys(t, origStore)
+	keys := addMaxKeys(t, store)
 
 	// delete one of the middle keys, and assert we can still create a new key
 	keyIDToDelete := keys[numSlots/2]
-	err = origStore.RemoveKey(keyIDToDelete)
+	err = store.RemoveKey(keyIDToDelete)
 	assert.NoError(t, err)
 
-	newKey, err := testAddKey(t, origStore)
+	newKey, err := testAddKey(t, store)
 	assert.NoError(t, err)
 
 	// create a new store, since we want to be sure the original store's cache
@@ -189,7 +189,7 @@ func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
 	// The new key should be in the original store, in the new clean store, and
 	// in the backup store.  The old key should not be in the original store,
 	// or the new clean store.
-	for _, store := range []trustmanager.KeyStore{origStore, cleanStore, backup} {
+	for _, store := range []trustmanager.KeyStore{store, cleanStore, backup} {
 		// new key should appear in all stores
 		gottenKey, _, err := store.GetKey(newKey.ID())
 		assert.NoError(t, err)
@@ -222,12 +222,12 @@ func TestYubiRemoveKey(t *testing.T) {
 	}()
 
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
 
-	key, err := testAddKey(t, origStore)
+	key, err := testAddKey(t, store)
 	assert.NoError(t, err)
-	err = origStore.RemoveKey(key.ID())
+	err = store.RemoveKey(key.ID())
 	assert.NoError(t, err)
 
 	// key remains in the backup store
@@ -242,7 +242,7 @@ func TestYubiRemoveKey(t *testing.T) {
 	assert.NoError(t, err)
 
 	// key is not in either the original store or the clean store
-	for _, store := range []*YubiKeyStore{origStore, cleanStore} {
+	for _, store := range []*YubiKeyStore{store, cleanStore} {
 		_, _, err := store.GetKey(key.ID())
 		assert.Error(t, err)
 	}
@@ -261,7 +261,7 @@ func TestYubiImportNewKey(t *testing.T) {
 	}()
 
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
 
 	// generate key and import it
@@ -271,7 +271,7 @@ func TestYubiImportNewKey(t *testing.T) {
 	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
-	err = origStore.ImportKey(pemBytes, "root")
+	err = store.ImportKey(pemBytes, "root")
 	assert.NoError(t, err)
 
 	// key is not in backup store
@@ -282,7 +282,7 @@ func TestYubiImportNewKey(t *testing.T) {
 	// is not masking any issues
 	cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
-	for _, store := range []*YubiKeyStore{origStore, cleanStore} {
+	for _, store := range []*YubiKeyStore{store, cleanStore} {
 		gottenKey, role, err := store.GetKey(privKey.ID())
 		assert.NoError(t, err)
 		assert.Equal(t, data.CanonicalRootRole, role)
@@ -303,9 +303,9 @@ func TestYubiImportExistingKey(t *testing.T) {
 		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
 	}()
 
-	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
-	key, err := testAddKey(t, origStore)
+	key, err := testAddKey(t, store)
 
 	backup := trustmanager.NewKeyMemoryStore(ret)
 	newStore, err := NewYubiKeyStore(backup, ret)
@@ -340,7 +340,7 @@ func TestYubiImportNonRootKey(t *testing.T) {
 	}()
 
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
 
 	// generate key and import it
@@ -350,7 +350,7 @@ func TestYubiImportNonRootKey(t *testing.T) {
 	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
-	err = origStore.ImportKey(pemBytes, privKey.ID())
+	err = store.ImportKey(pemBytes, privKey.ID())
 	assert.Error(t, err)
 
 	// key is not in backup store
@@ -517,17 +517,17 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
 	}()
 
 	backup := trustmanager.NewKeyMemoryStore(ret)
-	origStore, err := NewYubiKeyStore(backup, ret)
+	store, err := NewYubiKeyStore(backup, ret)
 	assert.NoError(t, err)
 
 	var _addkey = func() error {
-		_, err := testAddKey(t, origStore)
+		_, err := testAddKey(t, store)
 		return err
 	}
 
-	testYubiFunctionCleansUpOnLoginError(t, origStore, _addkey)
+	testYubiFunctionCleansUpOnLoginError(t, store, _addkey)
 	// all the PKCS11 functions AddKey depends on that aren't the login/logout
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _addkey,
 		append(
 			setupErrors,
 			"FindObjectsInit",
@@ -544,7 +544,7 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
 	// Logout should not cause a function failure - it s a cleanup failure,
 	// which shouldn't break anything, and it should clean up after itself.
 	// The key should be added to both stores
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _addkey,
 		[]string{"Logout"}, false)
 
 	listedKeys := cleanListKeys(t)
@@ -556,7 +556,7 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
 	// it's in, we assume its occupied slot is free (hence this failure will
 	// cause the previous key to be overwritten).  This behavior may need to
 	// be revisited.
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _addkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _addkey,
 		[]string{"GetAttributeValue"}, false)
 
 	newListedKeys := cleanListKeys(t)
@@ -612,7 +612,7 @@ func TestYubiImportKeyCleansUpOnError(t *testing.T) {
 		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
 	}()
 
-	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
 
 	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
@@ -621,11 +621,11 @@ func TestYubiImportKeyCleansUpOnError(t *testing.T) {
 	pemBytes, err := trustmanager.EncryptPrivateKey(privKey, "passphrase")
 	assert.NoError(t, err)
 
-	var _importkey = func() error { return origStore.ImportKey(pemBytes, "root") }
+	var _importkey = func() error { return store.ImportKey(pemBytes, "root") }
 
-	testYubiFunctionCleansUpOnLoginError(t, origStore, _importkey)
+	testYubiFunctionCleansUpOnLoginError(t, store, _importkey)
 	// all the PKCS11 functions ImportKey depends on that aren't the login/logout
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _importkey,
 		append(
 			setupErrors,
 			"FindObjectsInit",
@@ -641,7 +641,7 @@ func TestYubiImportKeyCleansUpOnError(t *testing.T) {
 	// Logout should not cause a function failure - it s a cleanup failure,
 	// which shouldn't break anything, and it should clean up after itself.
 	// The key should be added to both stores
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _importkey,
 		[]string{"Logout"}, false)
 
 	listedKeys := cleanListKeys(t)
@@ -653,10 +653,10 @@ func TestYubiImportKeyCleansUpOnError(t *testing.T) {
 	// cause the previous key to be overwritten).  This behavior may need to
 	// be revisited.
 	for k := range listedKeys {
-		err := origStore.RemoveKey(k)
+		err := store.RemoveKey(k)
 		assert.NoError(t, err)
 	}
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _importkey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _importkey,
 		[]string{"GetAttributeValue"}, false)
 
 	assert.Len(t, cleanListKeys(t), 1)
@@ -673,19 +673,19 @@ func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
 		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
 	}()
 
-	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
 	assert.NoError(t, err)
-	key, err := testAddKey(t, origStore)
+	key, err := testAddKey(t, store)
 	assert.NoError(t, err)
 
-	var _removekey = func() error { return origStore.RemoveKey(key.ID()) }
+	var _removekey = func() error { return store.RemoveKey(key.ID()) }
 
-	testYubiFunctionCleansUpOnLoginError(t, origStore, _removekey)
+	testYubiFunctionCleansUpOnLoginError(t, store, _removekey)
 	// RemoveKey just succeeds if we can't set up the yubikey
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey, setupErrors, false)
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _removekey, setupErrors, false)
 	// all the PKCS11 functions RemoveKey depends on that aren't the login/logout
 	// or setup/cleanup
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _removekey,
 		[]string{
 			"FindObjectsInit",
 			"FindObjects",
@@ -699,7 +699,7 @@ func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
 
 	// this will not fail, but it should clean up after itself, and the key
 	// should be added to both stores
-	testYubiFunctionCleansUpOnSpecifiedErrors(t, origStore, _removekey,
+	testYubiFunctionCleansUpOnSpecifiedErrors(t, store, _removekey,
 		[]string{"Logout"}, false)
 
 	assert.Len(t, cleanListKeys(t), 0)

From 4b7fefd5ef65f7823bd4484c3fe165d43ef94d20 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 19:51:57 -0800
Subject: [PATCH 78/85] Do not clean up a session if there is no session.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 Makefile                                  |  2 +-
 trustmanager/yubikey/yubikeystore.go      | 14 +++++++++-----
 trustmanager/yubikey/yubikeystore_test.go |  3 ++-
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index d6b7dc4c10..a45271ddda 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ GO_LDFLAGS=-ldflags "-w $(CTIMEVAR)"
 GO_LDFLAGS_STATIC=-ldflags "-w $(CTIMEVAR) -extldflags -static"
 GOOSES = darwin freebsd linux
 GOARCHS = amd64
-NOTARY_BUILDTAGS ?= "pkcs11"
+NOTARY_BUILDTAGS ?= pkcs11
 GO_EXC = go
 NOTARYDIR := /go/src/github.com/docker/notary
 
diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index 47a97dc9bd..5df3f430ed 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -771,7 +771,11 @@ func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
 	if err != nil {
 		logrus.Debugf("Error closing session: %s", err.Error())
 	}
-	err = ctx.Finalize()
+	finalizeAndDestroy(ctx)
+}
+
+func finalizeAndDestroy(ctx IPKCS11Ctx) {
+	err := ctx.Finalize()
 	if err != nil {
 		logrus.Debugf("Error finalizing: %s", err.Error())
 	}
@@ -792,18 +796,18 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
 	}
 
 	if err := p.Initialize(); err != nil {
-		defer cleanup(p, 0)
+		defer finalizeAndDestroy(p)
 		return nil, 0, fmt.Errorf("Initialize error %s", err.Error())
 	}
 
 	slots, err := p.GetSlotList(true)
 	if err != nil {
-		defer cleanup(p, 0)
+		defer finalizeAndDestroy(p)
 		return nil, 0, fmt.Errorf("Failed to list HSM slots %s", err)
 	}
 	// Check to see if we got any slots from the HSM.
 	if len(slots) < 1 {
-		defer cleanup(p, 0)
+		defer finalizeAndDestroy(p)
 		return nil, 0, fmt.Errorf("No HSM Slots found")
 	}
 
@@ -811,7 +815,7 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
 	// CKF_RW_SESSION: TRUE if the session is read/write; FALSE if the session is read-only
 	session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
 	if err != nil {
-		defer cleanup(p, 0)
+		defer cleanup(p, session)
 		return nil, 0, fmt.Errorf("Failed to Start Session with HSM %s", err)
 	}
 
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index ab53f2eaea..672a61eb35 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -64,7 +64,7 @@ func testAddKey(t *testing.T, store trustmanager.KeyStore) (data.PrivateKey, err
 }
 
 func addMaxKeys(t *testing.T, store trustmanager.KeyStore) []string {
-	keys := make([]string, 0, numSlots)
+	var keys []string
 	// create the maximum number of keys
 	for i := 0; i < numSlots; i++ {
 		privKey, err := testAddKey(t, store)
@@ -378,6 +378,7 @@ func TestYubiExportKeyFails(t *testing.T) {
 
 	_, err = store.ExportKey(key.ID())
 	assert.Error(t, err)
+	assert.Equal(t, "Keys cannot be exported from a Yubikey.", err.Error())
 }
 
 // If there are keys in the backup store but no keys in the Yubikey,

From 96bfaac05f9373c39fb8f0e9432d2a2be0d96d18 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 21:03:07 -0800
Subject: [PATCH 79/85] Add tests for verifying signatures before returning a
 signature.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore_test.go | 113 ++++++++++++++++++++++
 1 file changed, 113 insertions(+)

diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 672a61eb35..7605ce66a0 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -790,6 +790,95 @@ func TestYubiSignCleansUpOnError(t *testing.T) {
 		[]string{"Logout"}, false)
 }
 
+// If Sign gives us an invalid signature, we retry until successful up to
+// a maximum of 5 times.
+func TestYubiRetrySignUntilSuccess(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	key, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	message := []byte("Hello there")
+	goodSig, err := key.Sign(rand.Reader, message, nil)
+	assert.NoError(t, err)
+
+	privKey, _, err := store.GetKey(key.ID())
+	assert.NoError(t, err)
+
+	yubiPrivateKey, ok := privKey.(*YubiPrivateKey)
+	assert.True(t, ok)
+
+	badSigner := &SignInvalidSigCtx{
+		Ctx:     *pkcs11.New(pkcs11Lib),
+		goodSig: goodSig,
+		failNum: 2,
+	}
+
+	yubiPrivateKey.setLibLoader(func(string) IPKCS11Ctx { return badSigner })
+
+	sig, err := yubiPrivateKey.Sign(rand.Reader, message, nil)
+	assert.NoError(t, err)
+	// because the SignInvalidSigCtx returns the good signature, we can just
+	// deep equal instead of verifying
+	assert.True(t, reflect.DeepEqual(goodSig, sig))
+	assert.Equal(t, 3, badSigner.signCalls)
+}
+
+// If Sign gives us an invalid signature, we retry until up to a maximum of 5
+// times, and if it's still invalid, fail.
+func TestYubiRetrySign5TimesAndFail(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	key, err := testAddKey(t, store)
+	assert.NoError(t, err)
+
+	message := []byte("Hello there")
+	goodSig, err := key.Sign(rand.Reader, message, nil)
+	assert.NoError(t, err)
+
+	privKey, _, err := store.GetKey(key.ID())
+	assert.NoError(t, err)
+
+	yubiPrivateKey, ok := privKey.(*YubiPrivateKey)
+	assert.True(t, ok)
+
+	badSigner := &SignInvalidSigCtx{
+		Ctx:     *pkcs11.New(pkcs11Lib),
+		goodSig: goodSig,
+		failNum: 5,
+	}
+
+	yubiPrivateKey.setLibLoader(func(string) IPKCS11Ctx { return badSigner })
+
+	_, err = yubiPrivateKey.Sign(rand.Reader, message, nil)
+	assert.Error(t, err)
+	// because the SignInvalidSigCtx returns the good signature, we can just
+	// deep equal instead of verifying
+	assert.Equal(t, 5, badSigner.signCalls)
+}
+
 // -----  Stubbed pkcs11 for testing error conditions ------
 // This is just a passthrough to the underlying pkcs11 library, with optional
 // error injection.  This is to ensure that if errors occur during the process
@@ -966,3 +1055,27 @@ func (s *StubCtx) Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error)
 	}
 	return sig, sigErr
 }
+
+// a different stub Ctx object in which Sign returns an invalid signature some
+// number of times
+type SignInvalidSigCtx struct {
+	pkcs11.Ctx
+
+	// Signature verification is to mitigate against hardware failure while
+	// signing - which might occur during testing. So to prevent spurious
+	// errors, return a real known good signature in the success case.
+	goodSig []byte
+
+	failNum   int // number of calls to fail before succeeding
+	signCalls int // number of calls to Sign so far
+}
+
+func (s *SignInvalidSigCtx) Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error) {
+	s.signCalls++
+	s.Ctx.Sign(sh, message) // clear out the SignInit
+
+	if s.signCalls > s.failNum {
+		return s.goodSig, nil
+	}
+	return []byte("12345"), nil
+}

From 6cf0643d7d1fa6446c0ebf6a6fdc45bcf1885e7e Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 21:13:35 -0800
Subject: [PATCH 80/85] Roll back an add key to the yubikey if we can't back it
 up.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/yubikeystore.go      | 31 ++++++++----------
 trustmanager/yubikey/yubikeystore_test.go | 38 +++++++++++++++++++++++
 2 files changed, 51 insertions(+), 18 deletions(-)

diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index 5df3f430ed..1b933ac1ae 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -200,7 +200,6 @@ func addECDSAKey(
 	pkcs11KeyID []byte,
 	passRetriever passphrase.Retriever,
 	role string,
-	backupStore trustmanager.KeyStore,
 ) error {
 	logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID())
 
@@ -253,13 +252,6 @@ func addECDSAKey(
 		return fmt.Errorf("error importing: %v", err)
 	}
 
-	if backupStore != nil {
-		err = backupStore.AddKey(privKey.ID(), role, privKey)
-		if err != nil {
-			return ErrBackupFailed{err: err.Error()}
-		}
-	}
-
 	return nil
 }
 
@@ -639,11 +631,19 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 
 // AddKey puts a key inside the Yubikey, as well as writing it to the backup store
 func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error {
-	return s.addKey(keyID, role, privKey, true)
+	err := s.addKey(keyID, role, privKey)
+	if err != nil {
+		return err
+	}
+	err = s.backupStore.AddKey(privKey.ID(), role, privKey)
+	if err != nil {
+		defer s.RemoveKey(keyID)
+		return ErrBackupFailed{err: err.Error()}
+	}
+	return nil
 }
 
-func (s *YubiKeyStore) addKey(
-	keyID, role string, privKey data.PrivateKey, backup bool) error {
+func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) error {
 	// We only allow adding root keys for now
 	if role != data.CanonicalRootRole {
 		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s", role, keyID)
@@ -670,13 +670,8 @@ func (s *YubiKeyStore) addKey(
 	}
 	logrus.Debugf("Attempting to store key using yubikey slot %v", slot)
 
-	backupStore := s.backupStore
-	if !backup {
-		backupStore = nil
-	}
-
 	err = addECDSAKey(
-		ctx, session, privKey, slot, s.passRetriever, role, backupStore)
+		ctx, session, privKey, slot, s.passRetriever, role)
 	if err == nil {
 		s.keys[privKey.ID()] = yubiSlot{
 			role:   role,
@@ -763,7 +758,7 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 	if keyPath != data.CanonicalRootRole {
 		return fmt.Errorf("yubikey only supports storing root keys")
 	}
-	return s.addKey(privKey.ID(), "root", privKey, false)
+	return s.addKey(privKey.ID(), "root", privKey)
 }
 
 func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index 7605ce66a0..a38b0c697d 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -4,6 +4,7 @@ package yubikey
 
 import (
 	"crypto/rand"
+	"errors"
 	"fmt"
 	"reflect"
 	"testing"
@@ -209,6 +210,43 @@ func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
 	}
 }
 
+type nonworkingBackup struct {
+	trustmanager.KeyMemoryStore
+}
+
+// AddKey stores the contents of a PEM-encoded private key as a PEM block
+func (s *nonworkingBackup) AddKey(name, alias string, privKey data.PrivateKey) error {
+	return errors.New("Nope!")
+}
+
+// If, when adding a key to the Yubikey, we can't back up the key, it should
+// be removed from the Yubikey too because otherwise there is no way for
+// the user to later get a backup of the key.
+func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	backup := &nonworkingBackup{
+		KeyMemoryStore: *trustmanager.NewKeyMemoryStore(ret),
+	}
+	store, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+
+	_, err = testAddKey(t, store)
+	assert.Error(t, err)
+	assert.IsType(t, ErrBackupFailed{}, err)
+
+	// there should be no keys on the yubikey
+	assert.Len(t, cleanListKeys(t), 0)
+}
+
 // RemoveKey removes a key from the yubikey, but not from the backup store.
 func TestYubiRemoveKey(t *testing.T) {
 	if !YubikeyAccessible() {

From efff7219555934db7c3e42919350a872efb43fd1 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 21:46:48 -0800
Subject: [PATCH 81/85] Add tests for multi-keystore crypto services.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cryptoservice/crypto_service_test.go | 129 +++++++++++++++++++++++++++
 1 file changed, 129 insertions(+)

diff --git a/cryptoservice/crypto_service_test.go b/cryptoservice/crypto_service_test.go
index 832197a542..dc03a94095 100644
--- a/cryptoservice/crypto_service_test.go
+++ b/cryptoservice/crypto_service_test.go
@@ -1,6 +1,7 @@
 package cryptoservice
 
 import (
+	"crypto/rand"
 	"fmt"
 	"runtime"
 	"testing"
@@ -49,6 +50,29 @@ func (c CryptoServiceTester) TestCreateAndGetKey(t *testing.T) {
 	assert.Equal(t, c.role, alias)
 }
 
+// If there are multiple keystores, ensure that a key is only added to one -
+// the first in the list of keyStores (which is in order of preference)
+func (c CryptoServiceTester) TestCreateAndGetWhenMultipleKeystores(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	cryptoService.keyStores = append(cryptoService.keyStores,
+		trustmanager.NewKeyMemoryStore(passphraseRetriever))
+
+	// Test Create
+	tufKey, err := cryptoService.Create(c.role, c.keyAlgo)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+
+	// Only the first keystore should have the key
+	_, _, err = cryptoService.keyStores[0].GetKey(tufKey.ID())
+	assert.NoError(t, err)
+	_, _, err = cryptoService.keyStores[1].GetKey(tufKey.ID())
+	assert.Error(t, err)
+
+	// GetKey works across multiple keystores
+	retrievedKey := cryptoService.GetKey(tufKey.ID())
+	assert.NotNil(t, retrievedKey,
+		c.errorMsg("Could not find key ID %s", tufKey.ID()))
+}
+
 // asserts that getting key fails for a non-existent key
 func (c CryptoServiceTester) TestGetNonexistentKey(t *testing.T) {
 	cryptoService := c.cryptoServiceFactory()
@@ -81,6 +105,41 @@ func (c CryptoServiceTester) TestSignWithKey(t *testing.T) {
 		c.errorMsg("verification failed for %s key type", c.keyAlgo))
 }
 
+// asserts that signing, if there are no matching keys, produces no signatures
+func (c CryptoServiceTester) TestSignNoMatchingKeys(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	content := []byte("this is a secret")
+
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+
+	// Test Sign with key that is not in the cryptoservice
+	signatures, err := cryptoService.Sign([]string{privKey.ID()}, content)
+	assert.NoError(t, err, c.errorMsg("signing failed"))
+	assert.Len(t, signatures, 0, c.errorMsg("wrong number of signatures"))
+}
+
+// If there are multiple keystores, even if all of them have the same key,
+// only one signature is returned.
+func (c CryptoServiceTester) TestSignWhenMultipleKeystores(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	cryptoService.keyStores = append(cryptoService.keyStores,
+		trustmanager.NewKeyMemoryStore(passphraseRetriever))
+	content := []byte("this is a secret")
+
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+
+	for _, store := range cryptoService.keyStores {
+		err := store.AddKey(privKey.ID(), "root", privKey)
+		assert.NoError(t, err)
+	}
+
+	signatures, err := cryptoService.Sign([]string{privKey.ID()}, content)
+	assert.NoError(t, err, c.errorMsg("signing failed"))
+	assert.Len(t, signatures, 1, c.errorMsg("wrong number of signatures"))
+}
+
 // asserts that removing key that exists succeeds
 func (c CryptoServiceTester) TestRemoveCreatedKey(t *testing.T) {
 	cryptoService := c.cryptoServiceFactory()
@@ -96,6 +155,76 @@ func (c CryptoServiceTester) TestRemoveCreatedKey(t *testing.T) {
 	assert.Nil(t, retrievedKey, c.errorMsg("remove didn't work"))
 }
 
+// asserts that removing key will remove it from all keystores
+func (c CryptoServiceTester) TestRemoveFromMultipleKeystores(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	cryptoService.keyStores = append(cryptoService.keyStores,
+		trustmanager.NewKeyMemoryStore(passphraseRetriever))
+
+	privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+	assert.NoError(t, err, c.errorMsg("error creating key"))
+
+	for _, store := range cryptoService.keyStores {
+		err := store.AddKey(privKey.ID(), "root", privKey)
+		assert.NoError(t, err)
+	}
+
+	assert.NotNil(t, cryptoService.GetKey(privKey.ID()))
+
+	// Remove removes it from all key stores
+	err = cryptoService.RemoveKey(privKey.ID())
+	assert.NoError(t, err, c.errorMsg("could not remove key"))
+
+	for _, store := range cryptoService.keyStores {
+		_, _, err := store.GetKey(privKey.ID())
+		assert.Error(t, err)
+	}
+}
+
+// asserts that listing keys works with multiple keystores, and that the
+// same keys are deduplicated
+func (c CryptoServiceTester) TestListFromMultipleKeystores(t *testing.T) {
+	cryptoService := c.cryptoServiceFactory()
+	cryptoService.keyStores = append(cryptoService.keyStores,
+		trustmanager.NewKeyMemoryStore(passphraseRetriever))
+
+	var expectedKeysIDs map[string]bool // just want to be able to index by key
+
+	for i := 0; i < 3; i++ {
+		privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
+		assert.NoError(t, err, c.errorMsg("error creating key"))
+		expectedKeysIDs[privKey.ID()] = true
+
+		// adds one different key to each keystore, and then one key to
+		// both keystores
+		for j, store := range cryptoService.keyStores {
+			if i == j || i == 2 {
+				store.AddKey(privKey.ID(), "root", privKey)
+			}
+		}
+
+		// sanity check - each should have 2
+		for _, store := range cryptoService.keyStores {
+			assert.Len(t, store.ListKeys(), 2)
+		}
+	}
+
+	keyList := cryptoService.ListKeys("root")
+	assert.Len(t, keyList, 3)
+	for _, k := range keyList {
+		_, ok := expectedKeysIDs[k]
+		assert.True(t, ok)
+	}
+
+	keyMap := cryptoService.ListAllKeys()
+	assert.Len(t, keyMap, 3)
+	for k, role := range keyMap {
+		_, ok := expectedKeysIDs[k]
+		assert.True(t, ok)
+		assert.Equal(t, "root", role)
+	}
+}
+
 // Prints out an error message with information about the key algorithm,
 // role, and test name. Ideally we could generate different tests given
 // data, without having to put for loops in one giant test function, but

From 43f2d40e43408850e1f17158495a4770ef202c9b Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 22:07:49 -0800
Subject: [PATCH 82/85] Make our CI pick up trustmanager/yubikey again

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/yubikey/non_pkcs11.go | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 trustmanager/yubikey/non_pkcs11.go

diff --git a/trustmanager/yubikey/non_pkcs11.go b/trustmanager/yubikey/non_pkcs11.go
new file mode 100644
index 0000000000..77c07e6fe2
--- /dev/null
+++ b/trustmanager/yubikey/non_pkcs11.go
@@ -0,0 +1,9 @@
+// go list ./... and go test ./... will not pick up this package without this
+// file, because go ? ./... does not honor build tags.
+
+// e.g. "go list -tags pkcs11 ./..." will not list this package if all the
+// files in it have a build tag.
+
+// See https://github.com/golang/go/issues/11246
+
+package yubikey

From 87231d9a5d9fbeea3a3f5696229783a055aa2c06 Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 22:25:27 -0800
Subject: [PATCH 83/85] Fix new bug where adding a duplicate key to a yubikey
 added to the backup.

Added a test for this case as well - thanks @endophage!

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 trustmanager/keystore.go                  |  2 ++
 trustmanager/yubikey/yubikeystore.go      | 34 ++++++++++++--------
 trustmanager/yubikey/yubikeystore_test.go | 39 +++++++++++++++++++++--
 3 files changed, 59 insertions(+), 16 deletions(-)

diff --git a/trustmanager/keystore.go b/trustmanager/keystore.go
index 88a0e3d774..2d41e32b5e 100644
--- a/trustmanager/keystore.go
+++ b/trustmanager/keystore.go
@@ -40,6 +40,8 @@ const (
 
 // KeyStore is a generic interface for private key storage
 type KeyStore interface {
+	// Add Key adds a key to the KeyStore, and if the key already exists,
+	// succeeds.  Otherwise, returns an error if it cannot add.
 	AddKey(name, alias string, privKey data.PrivateKey) error
 	GetKey(name string) (data.PrivateKey, string, error)
 	ListKeys() map[string]string
diff --git a/trustmanager/yubikey/yubikeystore.go b/trustmanager/yubikey/yubikeystore.go
index 1b933ac1ae..3eacbf215d 100644
--- a/trustmanager/yubikey/yubikeystore.go
+++ b/trustmanager/yubikey/yubikeystore.go
@@ -631,42 +631,49 @@ func (s *YubiKeyStore) ListKeys() map[string]string {
 
 // AddKey puts a key inside the Yubikey, as well as writing it to the backup store
 func (s *YubiKeyStore) AddKey(keyID, role string, privKey data.PrivateKey) error {
-	err := s.addKey(keyID, role, privKey)
+	added, err := s.addKey(keyID, role, privKey)
 	if err != nil {
 		return err
 	}
-	err = s.backupStore.AddKey(privKey.ID(), role, privKey)
-	if err != nil {
-		defer s.RemoveKey(keyID)
-		return ErrBackupFailed{err: err.Error()}
+	if added {
+		err = s.backupStore.AddKey(privKey.ID(), role, privKey)
+		if err != nil {
+			defer s.RemoveKey(keyID)
+			return ErrBackupFailed{err: err.Error()}
+		}
 	}
 	return nil
 }
 
-func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) error {
+// Only add if we haven't seen the key already.  Return whether the key was
+// added.
+func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) (
+	bool, error) {
+
 	// We only allow adding root keys for now
 	if role != data.CanonicalRootRole {
-		return fmt.Errorf("yubikey only supports storing root keys, got %s for key: %s", role, keyID)
+		return false, fmt.Errorf(
+			"yubikey only supports storing root keys, got %s for key: %s", role, keyID)
 	}
 
 	ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
 	if err != nil {
 		logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
-		return err
+		return false, err
 	}
 	defer cleanup(ctx, session)
 
 	if k, ok := s.keys[keyID]; ok {
 		if k.role == role {
 			// already have the key and it's associated with the correct role
-			return nil
+			return false, nil
 		}
 	}
 
 	slot, err := getNextEmptySlot(ctx, session)
 	if err != nil {
 		logrus.Debugf("Failed to get an empty yubikey slot: %s", err.Error())
-		return err
+		return false, err
 	}
 	logrus.Debugf("Attempting to store key using yubikey slot %v", slot)
 
@@ -677,11 +684,11 @@ func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) error
 			role:   role,
 			slotID: slot,
 		}
-		return nil
+		return true, nil
 	}
 	logrus.Debugf("Failed to add key to yubikey: %v", err)
 
-	return err
+	return false, err
 }
 
 // GetKey retrieves a key from the Yubikey only (it does not look inside the
@@ -758,7 +765,8 @@ func (s *YubiKeyStore) ImportKey(pemBytes []byte, keyPath string) error {
 	if keyPath != data.CanonicalRootRole {
 		return fmt.Errorf("yubikey only supports storing root keys")
 	}
-	return s.addKey(privKey.ID(), "root", privKey)
+	_, err = s.addKey(privKey.ID(), "root", privKey)
+	return err
 }
 
 func cleanup(ctx IPKCS11Ctx, session pkcs11.SessionHandle) {
diff --git a/trustmanager/yubikey/yubikeystore_test.go b/trustmanager/yubikey/yubikeystore_test.go
index a38b0c697d..621b8dd11e 100644
--- a/trustmanager/yubikey/yubikeystore_test.go
+++ b/trustmanager/yubikey/yubikeystore_test.go
@@ -247,6 +247,39 @@ func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) {
 	assert.Len(t, cleanListKeys(t), 0)
 }
 
+// If, when adding a key to the Yubikey, and it already exists, we succeed
+// without adding it to the backup store.
+func TestYubiAddDuplicateKeySucceedsButDoesNotBackup(t *testing.T) {
+	if !YubikeyAccessible() {
+		t.Skip("Must have Yubikey access.")
+	}
+	clearAllKeys(t)
+
+	SetYubikeyKeyMode(KeymodeNone)
+	defer func() {
+		SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
+	}()
+
+	origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret)
+	assert.NoError(t, err)
+
+	key, err := testAddKey(t, origStore)
+	assert.NoError(t, err)
+
+	backup := trustmanager.NewKeyMemoryStore(ret)
+	cleanStore, err := NewYubiKeyStore(backup, ret)
+	assert.NoError(t, err)
+	assert.Len(t, cleanStore.ListKeys(), 1)
+
+	err = cleanStore.AddKey(key.ID(), "root", key)
+	assert.NoError(t, err)
+
+	// there should be just 1 key on the yubikey
+	assert.Len(t, cleanListKeys(t), 1)
+	// nothing was added to the backup
+	assert.Len(t, backup.ListKeys(), 0)
+}
+
 // RemoveKey removes a key from the yubikey, but not from the backup store.
 func TestYubiRemoveKey(t *testing.T) {
 	if !YubikeyAccessible() {
@@ -875,7 +908,7 @@ func TestYubiRetrySignUntilSuccess(t *testing.T) {
 
 // If Sign gives us an invalid signature, we retry until up to a maximum of 5
 // times, and if it's still invalid, fail.
-func TestYubiRetrySign5TimesAndFail(t *testing.T) {
+func TestYubiRetrySignUntilFail(t *testing.T) {
 	if !YubikeyAccessible() {
 		t.Skip("Must have Yubikey access.")
 	}
@@ -905,7 +938,7 @@ func TestYubiRetrySign5TimesAndFail(t *testing.T) {
 	badSigner := &SignInvalidSigCtx{
 		Ctx:     *pkcs11.New(pkcs11Lib),
 		goodSig: goodSig,
-		failNum: 5,
+		failNum: sigAttempts + 1,
 	}
 
 	yubiPrivateKey.setLibLoader(func(string) IPKCS11Ctx { return badSigner })
@@ -914,7 +947,7 @@ func TestYubiRetrySign5TimesAndFail(t *testing.T) {
 	assert.Error(t, err)
 	// because the SignInvalidSigCtx returns the good signature, we can just
 	// deep equal instead of verifying
-	assert.Equal(t, 5, badSigner.signCalls)
+	assert.Equal(t, sigAttempts, badSigner.signCalls)
 }
 
 // -----  Stubbed pkcs11 for testing error conditions ------

From 5d0893ef2ac4ef6e3f27a33ecc24ecf1ccc41a9e Mon Sep 17 00:00:00 2001
From: Ying Li <ying.li@docker.com>
Date: Wed, 11 Nov 2015 22:48:00 -0800
Subject: [PATCH 84/85] Oops, it'd be helpful if we actually ran the new
 CryptoService tests.

Signed-off-by: Ying Li <ying.li@docker.com>
Signed-off-by: David Lawrence <david.lawrence@docker.com>

Signed-off-by: Ying Li <ying.li@docker.com> (github: endophage)
---
 cryptoservice/crypto_service_test.go | 45 ++++++++++++++++++----------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/cryptoservice/crypto_service_test.go b/cryptoservice/crypto_service_test.go
index dc03a94095..41b9f45cc4 100644
--- a/cryptoservice/crypto_service_test.go
+++ b/cryptoservice/crypto_service_test.go
@@ -3,6 +3,7 @@ package cryptoservice
 import (
 	"crypto/rand"
 	"fmt"
+	"path/filepath"
 	"runtime"
 	"testing"
 
@@ -62,10 +63,16 @@ func (c CryptoServiceTester) TestCreateAndGetWhenMultipleKeystores(t *testing.T)
 	assert.NoError(t, err, c.errorMsg("error creating key"))
 
 	// Only the first keystore should have the key
-	_, _, err = cryptoService.keyStores[0].GetKey(tufKey.ID())
-	assert.NoError(t, err)
-	_, _, err = cryptoService.keyStores[1].GetKey(tufKey.ID())
-	assert.Error(t, err)
+	keyPath := tufKey.ID()
+	if c.role != data.CanonicalRootRole && cryptoService.gun != "" {
+		keyPath = filepath.Join(cryptoService.gun, keyPath)
+	}
+	_, _, err = cryptoService.keyStores[0].GetKey(keyPath)
+	assert.NoError(t, err, c.errorMsg(
+		"First keystore does not have the key %s", keyPath))
+	_, _, err = cryptoService.keyStores[1].GetKey(keyPath)
+	assert.Error(t, err, c.errorMsg(
+		"Second keystore has the key %s", keyPath))
 
 	// GetKey works across multiple keystores
 	retrievedKey := cryptoService.GetKey(tufKey.ID())
@@ -188,7 +195,7 @@ func (c CryptoServiceTester) TestListFromMultipleKeystores(t *testing.T) {
 	cryptoService.keyStores = append(cryptoService.keyStores,
 		trustmanager.NewKeyMemoryStore(passphraseRetriever))
 
-	var expectedKeysIDs map[string]bool // just want to be able to index by key
+	expectedKeysIDs := make(map[string]bool) // just want to be able to index by key
 
 	for i := 0; i < 3; i++ {
 		privKey, err := trustmanager.GenerateECDSAKey(rand.Reader)
@@ -202,22 +209,25 @@ func (c CryptoServiceTester) TestListFromMultipleKeystores(t *testing.T) {
 				store.AddKey(privKey.ID(), "root", privKey)
 			}
 		}
-
-		// sanity check - each should have 2
-		for _, store := range cryptoService.keyStores {
-			assert.Len(t, store.ListKeys(), 2)
-		}
+	}
+	// sanity check - each should have 2
+	for _, store := range cryptoService.keyStores {
+		assert.Len(t, store.ListKeys(), 2, c.errorMsg("added keys wrong"))
 	}
 
 	keyList := cryptoService.ListKeys("root")
-	assert.Len(t, keyList, 3)
+	assert.Len(t, keyList, 4,
+		c.errorMsg(
+			"ListKeys should have 4 keys (not necesarily unique) but does not: %v", keyList))
 	for _, k := range keyList {
 		_, ok := expectedKeysIDs[k]
-		assert.True(t, ok)
+		assert.True(t, ok, c.errorMsg("Unexpected key %s", k))
 	}
 
 	keyMap := cryptoService.ListAllKeys()
-	assert.Len(t, keyMap, 3)
+	assert.Len(t, keyMap, 3,
+		c.errorMsg("ListAllKeys should have 3 unique keys but does not: %v", keyMap))
+
 	for k, role := range keyMap {
 		_, ok := expectedKeysIDs[k]
 		assert.True(t, ok)
@@ -241,7 +251,7 @@ func (c CryptoServiceTester) errorMsg(message string, args ...interface{}) strin
 }
 
 func testCryptoService(t *testing.T, gun string) {
-	getCryptoService := func() *CryptoService {
+	getTestingCryptoService := func() *CryptoService {
 		return NewCryptoService(
 			gun, trustmanager.NewKeyMemoryStore(passphraseRetriever))
 	}
@@ -255,14 +265,19 @@ func testCryptoService(t *testing.T, gun string) {
 	for _, role := range roles {
 		for algo := range algoToSigType {
 			cst := CryptoServiceTester{
-				cryptoServiceFactory: getCryptoService,
+				cryptoServiceFactory: getTestingCryptoService,
 				role:                 role,
 				keyAlgo:              algo,
 			}
 			cst.TestCreateAndGetKey(t)
+			cst.TestCreateAndGetWhenMultipleKeystores(t)
 			cst.TestGetNonexistentKey(t)
 			cst.TestSignWithKey(t)
+			cst.TestSignNoMatchingKeys(t)
+			cst.TestSignWhenMultipleKeystores(t)
 			cst.TestRemoveCreatedKey(t)
+			cst.TestRemoveFromMultipleKeystores(t)
+			cst.TestListFromMultipleKeystores(t)
 		}
 	}
 }

From d2f69fe5bc9db96674e2e5aba8e4c60d9fc1a840 Mon Sep 17 00:00:00 2001
From: Diogo Monica <diogo@docker.com>
Date: Thu, 12 Nov 2015 01:22:40 -0800
Subject: [PATCH 85/85] Adding another path to search for ykcs libs

Signed-off-by: Diogo Monica <diogo@docker.com>
---
 trustmanager/yubikey/pkcs11_darwin.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/trustmanager/yubikey/pkcs11_darwin.go b/trustmanager/yubikey/pkcs11_darwin.go
index 9d0040a31d..f399dff3bb 100644
--- a/trustmanager/yubikey/pkcs11_darwin.go
+++ b/trustmanager/yubikey/pkcs11_darwin.go
@@ -5,4 +5,5 @@ package yubikey
 var possiblePkcs11Libs = []string{
 	"/usr/local/lib/libykcs11.dylib",
 	"/usr/local/docker/lib/libykcs11.dylib",
+	"/usr/local/docker-experimental/lib/libykcs11.dylib",
 }