docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-05 00:14:17 +03:00
Code Activity

Include trust pinning flow diagram

Browse Source 
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
This commit is contained in:
Riyaz Faizullabhoy
2016-04-04 16:00:46 -07:00
parent df3bd7dba6
commit b5534779df
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
certs/certs.go
View File

@@ -123,9 +123,7 @@ func ValidateRoot(certStore trustmanager.X509Store, root *data.Signed, gun strin
return &ErrValidationFail{Reason: "failed to validate data with current trusted certificates"}
}
} else {
logrus.Debugf("found no currently valid root certificates for %s", gun)
logrus.Debugf("using trust_pinning config to bootstrap trust: %v", trustPinning)
logrus.Debugf("found no currently valid root certificates for %s, using trust_pinning config to bootstrap trust:", gun, trustPinning)
trustPinChecker, err := NewTrustPinChecker(trustPinning, gun)
if err != nil {
return &ErrValidationFail{Reason: err.Error()}
@@ -146,7 +144,7 @@ func ValidateRoot(certStore trustmanager.X509Store, root *data.Signed, gun strin
if len(validPinnedCerts) == 0 {
return &ErrValidationFail{Reason: "unable to match any certificates to trust_pinning config"}
}
allValidCerts = validPinnedCerts
certsFromRoot = validPinnedCerts
}
// Validate the integrity of the new root (does it have valid signatures)

BIN
docs/images/trust-pinning-flow.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 62 KiB

12
docs/reference/client-config.md
View File

@@ -127,10 +127,16 @@ This section is optional, Notary will use TOFU over HTTPS by default and
trust certificates in the downloaded root file.
In this section, one can provide specific certificates to pin to, or a CA
to pin to as a root of trust for a GUN.
to pin to as a root of trust for a GUN. Multiple sections can be specified,
but the pinned certificates will take highest priority for validation, followed
by the pinned CA, followed by TOFUS (TOFU over HTTPS). The diagram below
describes this validation flow:
Only one trust pinning option can be used per GUN, and any validation failure
will result in a failed bootstrapping of the repo.
<center><img src="../images/trust-pinning-flow.png" alt="Trust pinning flow" width="400px"/></center>
Only one trust pinning option will be used to validate a GUN even if multiple
sections are specified, and any validation failure will result in a failed
bootstrapping of the repo.
<table>
<tr>