Merge pull request #1713 from aibaars/gcs-fix

GCS: FileWriter.Size: return offset + buffer size for Writers that are not closed

.dockerignore

@@ -1 +0,0 @@
-bin/

.forgejo/workflows/builds.yml

@@ -1,23 +0,0 @@
-on: [pull_request]
-
-jobs:
-  builds:
-    name: Builds
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go_versions: [ '1.21', '1.22' ]
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '${{ matrix.go_versions }}'
-
-      - name: Build binary
-        run: make
-
-      - name: Check dirty suffix
-        run: if [[ $(make version) == *"dirty"* ]]; then echo "Version has dirty suffix" && exit 1; fi

.forgejo/workflows/dco.yml

@@ -1,20 +0,0 @@
-on: [pull_request]
-
-jobs:
-  dco:
-    name: DCO
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-         fetch-depth: 0
-
-      - name: Setup Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.22'
-
-      - name: Run commit format checker
-        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v3
-        with:
-          from: 'origin/${{ github.event.pull_request.base.ref }}'

.forgejo/workflows/vulncheck.yml

@@ -1,21 +0,0 @@
-on: [pull_request]
-
-jobs:
-  vulncheck:
-    name: Vulncheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Setup Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.22'
-
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-
-      - name: Run govulncheck
-        run: govulncheck ./...

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,48 +0,0 @@
-name: Bug report
-description: Create a report to help us improve
-labels:
-  - kind/bug
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thank you for taking the time to report a bug!
-        If this is a security issue please report it to the [Distributions Security Mailing List](mailto:cncf-distribution-security@lists.cncf.io).
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: Please give a clear and concise description of the bug
-    validations:
-      required: true
-  - type: textarea
-    id: repro
-    attributes:
-      label: Reproduce
-      description: Steps to reproduce the bug
-      placeholder: |
-        1. start registry version X ...
-        2. `docker push image:tag` ...
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-      description: What is the expected behavior?
-      placeholder: |
-        E.g. "registry returns an incorrect API error"
-  - type: textarea
-    id: version
-    attributes:
-      label: registry version
-      description: Output of `registry --version`. Alternatively tell us the docker image tag.
-    validations:
-      required: true
-  - type: textarea
-    id: additional
-    attributes:
-      label: Additional Info
-      description: Additional info you want to provide such as logs, system info, environment, etc.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Security and Vulnerabilities
-    url: https://github.com/distribution/distribution/blob/main/SECURITY.md
-    about: Please report any security issues or vulnerabilities responsibly to the distribution maintainers team. Please do not use the public issue tracker.
-  - name: Questions and Discussions
-    url: https://github.com/distribution/distribution/discussions/new/choose
-    about: Use Github Discussions to ask questions and/or open discussion topics.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,12 +0,0 @@
-name: Feature request
-description: Missing functionality? Come tell us about it!
-labels:
-  - kind/feature
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: What is the feature you want to see?
-    validations:
-      required: true

.github/dependabot.yml

@@ -1,8 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    labels:
-      - "dependencies"

.github/labeler.yml

@@ -1,61 +0,0 @@
-area/api:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/api/**
-      - registry/handlers/**
-area/auth:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/auth/**
-area/build:
-  - changed-files:
-    - any-glob-to-any-file:
-      - Makefile
-      - Dockerfile
-      - docker-bake.hcl
-      - dockerfiles/**
-area/cache:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/storage/cache/**
-area/ci:
-  - changed-files:
-    - any-glob-to-any-file:
-      - .github/**
-      - tests/**
-      - testutil/**
-area/config:
-  - changed-files:
-    - any-glob-to-any-file:
-      - configuration/**
-area/docs:
-  - changed-files:
-    - any-glob-to-any-file:
-      - README.md
-      - docs/**/*.md
-area/proxy:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/proxy/**
-area/storage:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/storage/**
-area/storage/azure:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/storage/driver/azure/**
-area/storage/gcs:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/storage/driver/gcs/**
-area/storage/s3:
-  - changed-files:
-    - any-glob-to-any-file:
-      - registry/storage/driver/s3-aws/**
-dependencies:
-  - changed-files:
-    - any-glob-to-any-file:
-      - vendor/**
-      - go.mod
-      - go.sum

.github/workflows/build.yml

@@ -1,161 +0,0 @@
-name: build
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - 'main'
-      - 'release/*'
-    tags:
-      - 'v*'
-  pull_request:
-
-env:
-  DOCKERHUB_SLUG: distribution/distribution
-  GHCR_SLUG: ghcr.io/${{ github.repository }}
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        go:
-          - 1.21.8
-          - 1.22.1
-        target:
-          - test-coverage
-          - test-cloud-storage
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go }}
-      -
-        name: Test
-        run: |
-          make ${{ matrix.target }}
-      -
-        name: Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          directory: ./
-
-  build:
-    permissions:
-      contents: write # to create GitHub release (softprops/action-gh-release)
-      packages: write # so we can push the image to GHCR
-
-    runs-on: ubuntu-latest
-    needs:
-      - test
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.DOCKERHUB_SLUG }}
-            ${{ env.GHCR_SLUG }}
-          ### versioning strategy
-          ### push semver tag v3.2.1 on main (default branch)
-          # distribution/distribution:3.2.1
-          # distribution/distribution:3.2
-          # distribution/distribution:3
-          # distribution/distribution:latest
-          ### push semver prelease tag v3.0.0-beta.1 on main (default branch)
-          # distribution/distribution:3.0.0-beta.1
-          ### push on main
-          # distribution/distribution:edge
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=ref,event=pr
-            type=edge
-          labels: |
-            org.opencontainers.image.title=Distribution
-            org.opencontainers.image.description=The toolkit to pack, ship, store, and distribute container content
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Log in to GitHub Container registry
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build artifacts
-        uses: docker/bake-action@v4
-        with:
-          targets: artifact-all
-      -
-        name: Rename provenance
-        run: |
-          for pdir in ./bin/*/; do
-            (
-              cd "$pdir"
-              binname=$(find . -name '*.tar.gz')
-              filename=$(basename "${binname%.tar.gz}")
-              mv "provenance.json" "${filename}.provenance.json"
-            )
-          done
-      -
-        name: Move and list artifacts
-        run: |
-          mv ./bin/**/* ./bin/
-          tree -nh ./bin
-      -
-        name: Upload artifacts
-        uses: actions/upload-artifact@v4.3.0
-        with:
-          name: registry
-          path: ./bin/*
-          if-no-files-found: error
-      -
-        name: Build image
-        uses: docker/bake-action@v4
-        with:
-          files: |
-            ./docker-bake.hcl
-            ${{ steps.meta.outputs.bake-file }}
-          targets: image-all
-          push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
-      -
-        name: GitHub Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: |
-            bin/*.tar.gz
-            bin/*.provenance.json
-            bin/*.sha256
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -1,55 +0,0 @@
-name: CodeQL
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  schedule:
-    - cron: '0 12 * * 6'
-  push:
-    branches:
-      - 'main'
-      - 'release/*'
-    tags:
-      - 'v*'
-  pull_request:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  analyze:
-    permissions:
-      contents: read # to fetch code (actions/checkout)
-      security-events: write # to upload SARIF results (github/codeql-action/analyze)
-
-    name: Analyze
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        language:
-          - go
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-      -
-        name: Checkout HEAD on PR
-        if: ${{ github.event_name == 'pull_request' }}
-        run: |
-          git checkout HEAD^2
-      -
-        name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.22.12
-        with:
-          languages: ${{ matrix.language }}
-      -
-        name: Autobuild
-        uses: github/codeql-action/autobuild@v3.22.12
-      -
-        name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.22.12

.github/workflows/conformance.yml

@@ -1,56 +0,0 @@
-name: conformance
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  pull_request:
-  push:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  run-conformance-test:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      -
-        name: Build image
-        uses: docker/bake-action@v4
-        with:
-          targets: image-local
-      -
-        name: Start distribution server
-        run: |
-          IP=`hostname -I | awk '{print $1}'`
-          echo "IP=$IP" >> $GITHUB_ENV
-          echo "OCI_ROOT_URL=http://$IP:5000" >> $GITHUB_ENV
-          DISTRIBUTION_REF="registry:local"
-          docker run --rm -p 5000:5000 -e REGISTRY_STORAGE_DELETE_ENABLED=true -idt "registry:local"
-      -
-        name: Run OCI Distribution Spec conformance tests
-        uses: opencontainers/distribution-spec@v1.0.1
-        env:
-          OCI_ROOT_URL: ${{ env.OCI_ROOT_URL }}
-          OCI_NAMESPACE: oci-conformance/distribution-test
-          OCI_TEST_PULL: 1
-          OCI_TEST_PUSH: 1
-          OCI_TEST_CONTENT_DISCOVERY: 1
-          OCI_TEST_CONTENT_MANAGEMENT: 1
-          OCI_HIDE_SKIPPED_WORKFLOWS: 1
-      -
-        name: Move test results
-        run: mkdir -p .out/ && mv {report.html,junit.xml} .out/
-      -
-        name: Upload test results
-        uses: actions/upload-artifact@v4.3.0
-        with:
-          name: oci-test-results-${{ github.sha }}
-          path: .out/
-          if-no-files-found: error

.github/workflows/dockerhub-readme.yml

@@ -1,35 +0,0 @@
-name: dockerhub-readme
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - 'main'
-    paths:
-      - '.github/workflows/dockerhub-readme.yml'
-      - 'docs/dockerhub.md'
-
-env:
-  DOCKERHUB_SLUG: distribution/distribution
-
-permissions:
-  contents: read
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Update Docker Hub README
-        uses: peter-evans/dockerhub-description@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: ${{ env.DOCKERHUB_SLUG }}
-          readme-filepath: ./docs/dockerhub.md

.github/workflows/docs.yml

@@ -1,72 +0,0 @@
-name: docs
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - .github/workflows/docs.yml
-      - dockerfiles/docs.Dockerfile
-      - docs/**
-  workflow_dispatch:
-
-jobs:
-  # Build job
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    # Build the site and upload artifacts using actions/upload-pages-artifact
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Setup Pages
-        id: pages
-        uses: actions/configure-pages@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build docs
-        uses: docker/bake-action@v4
-        with:
-          files: |
-            docker-bake.hcl
-          targets: docs-export
-          provenance: false
-          set: |
-            *.cache-from=type=gha,scope=docs
-            *.cache-to=type=gha,scope=docs,mode=max
-      - name: Fix permissions
-        run: |
-          chmod -c -R +rX "./build/docs" | while read line; do
-            echo "::warning title=Invalid file permissions automatically fixed::$line"
-          done
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: ./build/docs
-
-  # Deploy job
-  deploy:
-    # Add a dependency to the build job
-    needs: build
-
-    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
-    permissions:
-      pages: write      # to deploy to Pages
-      id-token: write   # to verify the deployment originates from an appropriate source
-
-    # Deploy to the github-pages environment
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-
-    # Specify runner + deployment step
-    runs-on: ubuntu-latest
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4 # or the latest "vX.X.X" version tag for this action

.github/workflows/e2e.yml

@@ -1,56 +0,0 @@
-name: e2e
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - 'main'
-      - 'release/*'
-  pull_request:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  run-e2e-test:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      -
-        name: Build image
-        uses: docker/bake-action@v4
-        with:
-          targets: image-local
-      -
-        name: Start distribution server
-        run: |
-          docker run --rm -p 5000:5000 -p 5001:5001 -idt "registry:local"
-      -
-        name: Tests
-        run: |
-          bash ./tests/push.sh 127.0.0.0
-
-  run-e2e-test-s3-storage:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      -
-        name: Start E2E environment
-        run: |
-          make start-e2e-s3-env
-
-      - name: Tests
-        run: |
-          bash ./tests/push.sh 127.0.0.0
-          make stop-e2e-s3-env

.github/workflows/fossa.yml

@@ -1,25 +0,0 @@
-name: FOSSA License Scanning
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  - pull_request
-  - push
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  scan-license:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Run FOSSA scan and upload build data
-        uses: fossa-contrib/fossa-action@v3
-        with:
-          fossa-api-key: cac3dc8d4f2ba86142f6c0f2199a160f

.github/workflows/label.yaml

@@ -1,19 +0,0 @@
-name: Pull Request Labeler
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  pull_request_target:
-
-jobs:
-  labeler:
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/labeler@v5
-      with:
-        dot: true

.github/workflows/scorecards.yml

@@ -1,60 +0,0 @@
-name: Scorecards supply-chain security
-on:
-  # Only the default branch is supported.
-  branch_protection_rule:
-  schedule:
-    - cron: '26 0 * * 0'
-  push:
-    branches: [ "main" ]
-
-# Declare default permissions as read only.
-permissions: read-all
-
-jobs:
-  analysis:
-    name: Scorecards analysis
-    runs-on: ubuntu-latest
-    permissions:
-      # Needed to upload the results to code-scanning dashboard.
-      security-events: write
-      # Used to receive a badge.
-      id-token: write
-
-    steps:
-      - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
-        with:
-          persist-credentials: false
-
-      - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # tag=v2.3.1
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
-          # - you want to enable the Branch-Protection check on a *public* repository, or
-          # - you are installing Scorecards on a *private* repository
-          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
-          # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
-
-          # Publish the results for public repositories to enable scorecard badges. For more details, see
-          # https://github.com/ossf/scorecard-action#publishing-results.
-          # For private repositories, `publish_results` will automatically be set to `false`, regardless
-          # of the value entered here.
-          publish_results: true
-
-      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
-      # format to the repository Actions tab.
-      - name: "Upload artifact"
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # tag=v4.3.0
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard.
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1500a131381b66de0c52ac28abb13cd79f4b7ecc # tag=v2.22.12
-        with:
-          sarif_file: results.sarif
-

.github/workflows/validate.yml

@@ -1,38 +0,0 @@
-name: validate
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  push:
-    branches:
-      - 'main'
-      - 'release/*'
-    tags:
-      - 'v*'
-  pull_request:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        target:
-          - lint
-          - validate-vendor
-          - validate-git
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Run
-        run: |
-          make ${{ matrix.target }}
-        env:
-          COMMIT_RANGE: ${{ format('{0}..{1}', github.sha, 'HEAD') }}

.gitignore

@@ -35,11 +35,3 @@ bin/*
 # Editor/IDE specific files.
 *.sublime-project
 *.sublime-workspace
-.idea/*
-
-tests/miniodata
-
-# Docs
-**/.hugo_build.lock
-docs/resources
-docs/public

.golangci.yml

@@ -1,28 +0,0 @@
-linters:
-  enable:
-    - staticcheck
-    - unconvert
-    - gofmt
-    - goimports
-    - revive
-    - ineffassign
-    - govet
-    - unused
-    - misspell
-    - bodyclose
-    - prealloc
-    - errcheck
-    - tparallel
-
-linters-settings:
-  revive:
-    rules:
-      # TODO(thaJeztah): temporarily disabled the "unused-parameter" check.
-      # It produces many warnings, and some of those may need to be looked at.
-      - name: unused-parameter
-        disabled: true
-
-issues:
-  deadline: 2m
-  exlude-dirs:
-    - vendor

.mailmap

@@ -1,194 +1,16 @@
-Aaron Lehmann <alehmann@netflix.com>
-Aaron Lehmann <alehmann@netflix.com> <aaron.lehmann@docker.com>
-Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
-Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> <suda.akihiro@lab.ntt.co.jp>
-Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> <suda.kyoto@gmail.com>
-Alexander Morozov <lk4d4math@gmail.com>
-Alexander Morozov <lk4d4math@gmail.com> <lk4d4@docker.com>
-Anders Ingemann <aim@orbit.online>
-Andrew Meredith <andymeredith@gmail.com>
-Andrew Meredith <andymeredith@gmail.com> <kendru@users.noreply.github.com>
-Andrey Smirnov <andrey.smirnov@siderolabs.com>
-Andrii Soldatenko <andrii.soldatenko@gmail.com>
-Andrii Soldatenko <andrii.soldatenko@gmail.com> <andrii.soldatenko@dynatrace.com>
-Anthony Ramahay <thewolt@gmail.com>
-Antonio Murdaca <antonio.murdaca@gmail.com>
-Antonio Murdaca <antonio.murdaca@gmail.com> <amurdaca@redhat.com>
-Antonio Murdaca <antonio.murdaca@gmail.com> <me@runcom.ninja>
-Antonio Murdaca <antonio.murdaca@gmail.com> <runcom@linux.com>
-Antonio Murdaca <antonio.murdaca@gmail.com> <runcom@redhat.com>
-Antonio Murdaca <antonio.murdaca@gmail.com> <runcom@users.noreply.github.com>
-Austin Vazquez <macedonv@amazon.com>
-Benjamin Schanzel <benjamin.schanzel@bmw.de>
-Brian Bland <brian.t.bland@gmail.com>
-Brian Bland <brian.t.bland@gmail.com> <brian.bland@docker.com>
-Brian Bland <brian.t.bland@gmail.com> <r4nd0m1n4t0r@gmail.com>
-Chad Faragher <wyckster@hotmail.com>
-Cory Snider <csnider@mirantis.com>
-CrazyMax <github@crazymax.dev>
-CrazyMax <github@crazymax.dev> <1951866+crazy-max@users.noreply.github.com>
-CrazyMax <github@crazymax.dev> <crazy-max@users.noreply.github.com>
-Cristian Staretu <cristian.staretu@gmail.com>
-Cristian Staretu <cristian.staretu@gmail.com> <unclejack@users.noreply.github.com>
-Cristian Staretu <cristian.staretu@gmail.com> <unclejacksons@gmail.com>
-Daniel Nephin <dnephin@gmail.com>
-Daniel Nephin <dnephin@gmail.com> <dnephin@docker.com>
-David Karlsson <david.karlsson@docker.com>
-David Karlsson <david.karlsson@docker.com> <35727626+dvdksn@users.noreply.github.com>
-David Wu <dwu7401@gmail.com>
-David Wu <dwu7401@gmail.com> <david.wu@docker.com>
-Derek McGowan <derek@mcg.dev>
-Derek McGowan <derek@mcg.dev> <derek@mcgstyle.net>
-Dimitar Kostadinov <dimitar.kostadinov@sap.com>
-Doug Davis <dug@us.ibm.com>
-Doug Davis <dug@us.ibm.com> <duglin@users.noreply.github.com>
-Emmanuel Ferdman <emmanuelferdman@gmail.com>
-Eng Zer Jun <engzerjun@gmail.com>
-Eric Yang <windfarer@gmail.com>
-Eric Yang <windfarer@gmail.com> <Windfarer@users.noreply.github.com>
-Eric Yang <windfarer@gmail.com> <qizhao.yang@daocloud.io>
-Erica Windisch <erica@windisch.us>
-Erica Windisch <erica@windisch.us> <eric@windisch.us>
-Guillaume J. Charmes <charmes.guillaume@gmail.com>
-Guillaume J. Charmes <charmes.guillaume@gmail.com> <guillaume.charmes@dotcloud.com>
-Guillaume J. Charmes <charmes.guillaume@gmail.com> <guillaume@charmes.net>
-Guillaume J. Charmes <charmes.guillaume@gmail.com> <guillaume@docker.com>
-Guillaume J. Charmes <charmes.guillaume@gmail.com> <guillaume@dotcloud.com>
-Hayley Swimelar <hswimelar@gmail.com>
-Ismail Alidzhikov <i.alidjikov@gmail.com>
-Jaime Martinez <jmartinez@gitlab.com>
-James Hewitt <james.hewitt@uk.ibm.com>
-Jessica Frazelle <jess@oxide.computer>
-Jessica Frazelle <jess@oxide.computer> <acidburn@docker.com>
-Jessica Frazelle <jess@oxide.computer> <acidburn@google.com>
-Jessica Frazelle <jess@oxide.computer> <acidburn@microsoft.com>
-Jessica Frazelle <jess@oxide.computer> <jess@docker.com>
-Jessica Frazelle <jess@oxide.computer> <jess@mesosphere.com>
-Jessica Frazelle <jess@oxide.computer> <jessfraz@google.com>
-Jessica Frazelle <jess@oxide.computer> <jfrazelle@users.noreply.github.com>
-Jessica Frazelle <jess@oxide.computer> <me@jessfraz.com>
-Jessica Frazelle <jess@oxide.computer> <princess@docker.com>
-Joao Fernandes <joaofnfernandes@gmail.com>
-Joao Fernandes <joaofnfernandes@gmail.com> <joao.fernandes@docker.com>
-João Pereira <484633+joaodrp@users.noreply.github.com>
-Joffrey F <joffrey@docker.com>
-Joffrey F <joffrey@docker.com> <f.joffrey@gmail.com>
-Joffrey F <joffrey@docker.com> <joffrey@dotcloud.com>
-Johan Euphrosine <proppy@google.com>
-Johan Euphrosine <proppy@google.com> <proppy@aminche.com>
-John Howard <github@lowenna.com>
-John Howard <github@lowenna.com> <jhoward@microsoft.com>
-Josh Hawn <jlhawn@berkeley.edu>
-Josh Hawn <jlhawn@berkeley.edu> <josh.hawn@docker.com>
-Joyce Brum <joycebrumu.u@gmail.com>
-Joyce Brum <joycebrumu.u@gmail.com> <joycebrum@google.com>
-Justin Cormack <justin.cormack@docker.com>
-Justin Cormack <justin.cormack@docker.com> <justin.cormack@unikernel.com>
-Justin Cormack <justin.cormack@docker.com> <justin@specialbusservice.com>
-Kirat Singh <kirat.singh@gmail.com>
-Kirat Singh <kirat.singh@gmail.com> <kirat.singh@beacon.io>
-Kirat Singh <kirat.singh@gmail.com> <kirat.singh@wsq.io>
-Kyle Squizzato <ksquizz@gmail.com>
-Liang Zheng <zhengliang0901@gmail.com>
-Luca Bruno <lucab@debian.org>
-Luca Bruno <lucab@debian.org> <luca.bruno@coreos.com>
-Mahmoud Kandil <47168819+MahmoudKKandil@users.noreply.github.com>
-Manish Tomar <manish.tomar@docker.com>
-Manish Tomar <manish.tomar@docker.com> <manishtomar@users.noreply.github.com>
-Maria Bermudez <bermudez.mt@gmail.com>
-Maria Bermudez <bermudez.mt@gmail.com> <bermudezmt@users.noreply.github.com>
-Markus Thömmes <markusthoemmes@me.com>
-Matt Linville <matt@linville.me>
-Matt Linville <matt@linville.me> <misty@apache.org>
-Matt Linville <matt@linville.me> <misty@docker.com>
-Michael Crosby <crosbymichael@gmail.com>
-Michael Crosby <crosbymichael@gmail.com> <crosby.michael@gmail.com>
-Michael Crosby <crosbymichael@gmail.com> <michael@crosbymichael.com>
-Michael Crosby <crosbymichael@gmail.com> <michael@docker.com>
-Michael Crosby <crosbymichael@gmail.com> <michael@thepasture.io>
-Michal Minar <miminar@redhat.com>
-Michal Minar <miminar@redhat.com> Michal Minář <miminar@redhat.com>
-Mike Brown <brownwm@us.ibm.com>
-Mike Brown <brownwm@us.ibm.com> <mikebrow@users.noreply.github.com>
-Mikel Rychliski <mikel@mikelr.com>
-Milos Gajdos <milosthegajdos@gmail.com>
-Milos Gajdos <milosthegajdos@gmail.com> <1392526+milosgajdos@users.noreply.github.com>
-Milos Gajdos <milosthegajdos@gmail.com> <milosgajdos83@gmail.com>
-Nikita Tarasov <nikita@mygento.ru>
-Nikita Tarasov <nikita@mygento.ru> <luckyraul@users.noreply.github.com>
-Oleg Bulatov <oleg@bulatov.me>
-Oleg Bulatov <oleg@bulatov.me> <obulatov@redhat.com>
-Olivier Gambier <olivier@docker.com>
-Olivier Gambier <olivier@docker.com> <dmp42@users.noreply.github.com>
-Omer Cohen <git@omer.io>
-Omer Cohen <git@omer.io> <git@omerc.net>
-Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Per Lundberg <perlun@gmail.com>
-Per Lundberg <perlun@gmail.com> <per.lundberg@ecraft.com>
-Peter Dave Hello <hsu@peterdavehello.org>
-Peter Dave Hello <hsu@peterdavehello.org> <PeterDaveHello@users.noreply.github.com>
-Phil Estes <estesp@gmail.com>
-Phil Estes <estesp@gmail.com> <estesp@amazon.com>
-Phil Estes <estesp@gmail.com> <estesp@linux.vnet.ibm.com>
-Richard Scothern <richard.scothern@gmail.com>
-Richard Scothern <richard.scothern@gmail.com> <richard.scothern@docker.com>
-Rober Morales-Chaparro <rober.morales@rstor.io>
-Rober Morales-Chaparro <rober.morales@rstor.io> <rober@rstor.io>
-Robin Ketelbuters <robin.ketelbuters@gmail.com>
-Sebastiaan van Stijn <github@gone.nl>
-Sebastiaan van Stijn <github@gone.nl> <moby@example.com>
-Sebastiaan van Stijn <github@gone.nl> <sebastiaan@ws-key-sebas3.dpi1.dpi>
-Sebastiaan van Stijn <github@gone.nl> <thaJeztah@users.noreply.github.com>
-Sharif Nassar <sharif@mrwacky.com>
-Sharif Nassar <sharif@mrwacky.com> <mrwacky42@users.noreply.github.com>
-Solomon Hykes <solomon@dagger.io>
-Solomon Hykes <solomon@dagger.io> <s@docker.com>
-Solomon Hykes <solomon@dagger.io> <solomon.hykes@dotcloud.com>
-Solomon Hykes <solomon@dagger.io> <solomon@docker.com>
-Solomon Hykes <solomon@dagger.io> <solomon@dotcloud.com>
-Stephen Day <stevvooe@gmail.com>
-Stephen Day <stevvooe@gmail.com> <stephen.day@docker.com>
-Stephen Day <stevvooe@gmail.com> <stevvooe@users.noreply.github.com>
-Steven Kalt <SKalt@users.noreply.github.com>
-Sven Dowideit <SvenDowideit@home.org.au>
-Sven Dowideit <SvenDowideit@home.org.au> <SvenDowideit@users.noreply.github.com>
-Sylvain DESGRAIS <sylvain.desgrais@gmail.com>
-Tadeusz Dudkiewicz <tadeusz.dudkiewicz@rtbhouse.com>
-Tibor Vass <teabee89@gmail.com>
-Tibor Vass <teabee89@gmail.com> <tibor@docker.com>
-Tibor Vass <teabee89@gmail.com> <tiborvass@users.noreply.github.com>
-Victor Vieux <victorvieux@gmail.com>
-Victor Vieux <victorvieux@gmail.com> <dev@vvieux.com>
-Victor Vieux <victorvieux@gmail.com> <victor.vieux@docker.com>
-Victor Vieux <victorvieux@gmail.com> <victor.vieux@dotcloud.com>
-Victor Vieux <victorvieux@gmail.com> <victor@docker.com>
-Victor Vieux <victorvieux@gmail.com> <victor@dotcloud.com>
-Victor Vieux <victorvieux@gmail.com> <victorvieux@gmail.com>
-Victor Vieux <victorvieux@gmail.com> <vieux@docker.com>
-Victoria Bialas <victoria.bialas@docker.com>
-Victoria Bialas <victoria.bialas@docker.com> <londoncalling@users.noreply.github.com>
-Vincent Batts <vbatts@redhat.com>
-Vincent Batts <vbatts@redhat.com> <vbatts@hashbangbash.com>
-Vincent Demeester <vincent.demeester@docker.com>
-Vincent Demeester <vincent.demeester@docker.com> <vincent+github@demeester.fr>
-Vincent Demeester <vincent.demeester@docker.com> <vincent@demeester.fr>
-Vincent Demeester <vincent.demeester@docker.com> <vincent@sbr.pm>
-Vincent Giersch <vincent@giersch.fr>
-Vincent Giersch <vincent@giersch.fr> <vincent.giersch@ovh.net>
-Wang Yan <wangyan@vmware.com>
-Wen-Quan Li <legendarilylwq@gmail.com>
-Wen-Quan Li <legendarilylwq@gmail.com> <wenquan.li@hp.com>
-Wen-Quan Li <legendarilylwq@gmail.com> <wenquan.li@hpe.com>
-Yu Wang <yuwa@microsoft.com>
-Yu Wang <yuwa@microsoft.com> Yu Wang (UC) <yuwa@microsoft.com>
-baojiangnan <baojiangnan@meituan.com>
-baojiangnan <baojiangnan@meituan.com> <baojn1998@163.com>
-erezrokah <erezrokah@users.noreply.github.com>
-goodactive <goodactive@qq.com>
-gotgelf <gotgelf@gmail.com>
-guoguangwu <guoguangwug@gmail.com>
-harche <p.harshal@gmail.com>
-harche <p.harshal@gmail.com> <harche@users.noreply.github.com>
-icefed <zlwangel@gmail.com>
-oliver-goetz <o.goetz@sap.com>
-xiaoxiangxianzi <zhaoyizheng@outlook.com>
+Stephen J Day <stephen.day@docker.com>  Stephen Day <stevvooe@users.noreply.github.com>
+Stephen J Day <stephen.day@docker.com>  Stephen Day <stevvooe@gmail.com>
+Olivier Gambier <olivier@docker.com>    Olivier Gambier <dmp42@users.noreply.github.com>
+Brian Bland <brian.bland@docker.com>    Brian Bland <r4nd0m1n4t0r@gmail.com>
+Brian Bland <brian.bland@docker.com> Brian Bland <brian.t.bland@gmail.com>
+Josh Hawn <josh.hawn@docker.com>        Josh Hawn <jlhawn@berkeley.edu>
+Richard Scothern <richard.scothern@docker.com> Richard <richard.scothern@gmail.com>
+Richard Scothern <richard.scothern@docker.com> Richard Scothern <richard.scothern@gmail.com>
+Andrew Meredith <andymeredith@gmail.com> Andrew Meredith <kendru@users.noreply.github.com>
+harche <p.harshal@gmail.com> harche <harche@users.noreply.github.com>
+Jessie Frazelle <jessie@docker.com>  <jfrazelle@users.noreply.github.com>
+Sharif Nassar <sharif@mrwacky.com> Sharif Nassar <mrwacky42@users.noreply.github.com>
+Sven Dowideit <SvenDowideit@home.org.au> Sven Dowideit <SvenDowideit@users.noreply.github.com>
+Vincent Giersch <vincent.giersch@ovh.net> Vincent Giersch <vincent@giersch.fr>
+davidli <wenquan.li@hp.com> davidli <wenquan.li@hpe.com>
+Omer Cohen <git@omer.io> Omer Cohen <git@omerc.net>

ADOPTERS.md

@@ -1,11 +0,0 @@
-Docker Hub https://hub.docker.com/
-
-GitLab Container Registry https://docs.gitlab.com/ee/user/packages/container_registry/
-
-GitHub Container Registry https://docs.github.com/en/free-pro-team@latest/packages/guides/about-github-container-registry
-
-Harbor, CNCF Graduated project https://goharbor.io/
-
-VMware Harbor Registry https://docs.pivotal.io/partners/vmware-harbor/index.html
-
-DigitalOcean Container Registry https://www.digitalocean.com/products/container-registry/

AUTHORS

@@ -1,530 +1,133 @@
-# This file lists all individuals having contributed content to the repository.
-# For how it is generated, see dockerfiles/authors.Dockerfile.
-
-a-palchikov <deemok@gmail.com>
-Aaron Lehmann <alehmann@netflix.com>
+Aaron Lehmann <aaron.lehmann@docker.com>
 Aaron Schlesinger <aschlesinger@deis.com>
 Aaron Vinson <avinson.public@gmail.com>
-Adam Dobrawy <ad-m@users.noreply.github.com>
-Adam Duke <adam.v.duke@gmail.com>
 Adam Enger <adamenger@gmail.com>
-Adam Kaplan <adam.kaplan@redhat.com>
-Adam Wolfe Gordon <awg@digitalocean.com>
-AdamKorcz <adam@adalogics.com>
 Adrian Mouat <adrian.mouat@gmail.com>
-Adrian Plata <adrian.plata@docker.com>
-Adrien Duermael <adrien@duermael.com>
 Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>
-Aidan Hobson Sayers <aidanhs@cantab.net>
-Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
-Aleksejs Sinicins <monder@monder.cc>
-Alex <aleksandrosansan@gmail.com>
 Alex Chan <alex.chan@metaswitch.com>
 Alex Elman <aelman@indeed.com>
-Alex Laties <agl@tumblr.com>
-Alexander Larsson <alexl@redhat.com>
-Alexander Morozov <lk4d4math@gmail.com>
-Alexey Gladkov <gladkov.alexey@gmail.com>
-Alfonso Acosta <fons@syntacticsugar.consulting>
-allencloud <allen.sun@daocloud.io>
-Alvin Feng <alvin4feng@yahoo.com>
 amitshukla <ashukla73@hotmail.com>
 Amy Lindburg <amy.lindburg@docker.com>
-Andreas Hassing <andreas@famhassing.dk>
-Andrew Bulford <andrew.bulford@redmatter.com>
-Andrew Hsu <andrewhsu@acm.org>
-Andrew Lavery <laverya@umich.edu>
-Andrew Leung <anwleung@gmail.com>
-Andrew Lively <andrew.lively2@gmail.com>
 Andrew Meredith <andymeredith@gmail.com>
 Andrew T Nguyen <andrew.nguyen@docker.com>
-Andrews Medina <andrewsmedina@gmail.com>
 Andrey Kostov <kostov.andrey@gmail.com>
-Andrii Soldatenko <andrii.soldatenko@gmail.com>
 Andy Goldstein <agoldste@redhat.com>
-andyzhangx <xiazhang@microsoft.com>
-Anian Z <ziegler@sicony.de>
-Anil Belur <askb23@gmail.com>
-Anis Elleuch <vadmeste@gmail.com>
-Ankush Agarwal <ankushagarwal11@gmail.com>
-Anne Henmi <41210220+ahh-docker@users.noreply.github.com>
 Anton Tiurin <noxiouz@yandex.ru>
 Antonio Mercado <amercado@thinknode.com>
-Antonio Murdaca <antonio.murdaca@gmail.com>
-Antonio Ojea <antonio.ojea.garcia@gmail.com>
-Anusha Ragunathan <anusha@docker.com>
-Arien Holthuizen <aholthuizen@schubergphilis.com>
-Arko Dasgupta <arkodg@users.noreply.github.com>
+Antonio Murdaca <runcom@redhat.com>
 Arnaud Porterie <arnaud.porterie@docker.com>
 Arthur Baars <arthur@semmle.com>
-Arthur Gautier <baloo@gandi.net>
 Asuka Suzuki <hello@tanksuzuki.com>
 Avi Miller <avi.miller@oracle.com>
-Aviral Takkar <aviral26@users.noreply.github.com>
 Ayose Cazorla <ayosec@gmail.com>
 BadZen <dave.trombley@gmail.com>
-baojiangnan <baojiangnan@meituan.com>
-Ben Bodenmiller <bbodenmiller@hotmail.com>
-Ben De St Paer-Gotch <bende@outlook.com>
-Ben Emamian <ben@ictace.com>
 Ben Firshman <ben@firshman.co.uk>
-Ben Kochie <superq@gmail.com>
-Ben Manuel <ben.manuel@procore.com>
-Bhavin Gandhi <bhavin192@users.noreply.github.com>
-Bill <NonCreature0714@users.noreply.github.com>
 bin liu <liubin0329@gmail.com>
-Bouke van der Bijl <me@bou.ke>
-Bracken Dawson <abdawson@gmail.com>
-Brandon Mitchell <git@bmitch.net>
-Brandon Philips <brandon@ifup.co>
-Brett Higgins <brhiggins@arbor.net>
-Brian Bland <brian.t.bland@gmail.com>
-Brian Goff <cpuguy83@gmail.com>
+Brian Bland <brian.bland@docker.com>
 burnettk <burnettk@gmail.com>
-Caleb Spare <cespare@gmail.com>
 Carson A <ca@carsonoid.net>
-Cezar Sa Espinola <cezarsa@gmail.com>
-Chad Faragher <wyckster@hotmail.com>
-Chaos John <chaosjohn.yjh@icloud.com>
-Charles Smith <charles.smith@docker.com>
-Cheng Zheng <chengzheng.apply@gmail.com>
-chlins <chenyuzh@vmware.com>
-Chris Aniszczyk <caniszczyk@gmail.com>
 Chris Dillon <squarism@gmail.com>
-Chris K. Wong <chriskw.xyz@gmail.com>
-Chris Patterson <chrispat@github.com>
-Christopher Yeleighton <ne01026@shark.2a.pl>
-Christy Perez <christy@linux.vnet.ibm.com>
-Chuanying Du <cydu@google.com>
-Clayton Coleman <ccoleman@redhat.com>
-Collin Shoop <cshoop@digitalocean.com>
-Corey Quon <corey.quon@gmail.com>
-Cory Snider <csnider@mirantis.com>
-CrazyMax <github@crazymax.dev>
-cressie176 <github@stephen-cresswell.net>
-Cristian Staretu <cristian.staretu@gmail.com>
-cui fliter <imcusg@gmail.com>
-cuiwei13 <cuiwei13@pku.edu.cn>
-cyli <cyli@twistedmatrix.com>
-Daehyeok Mun <daehyeok@gmail.com>
 Daisuke Fujita <dtanshi45@gmail.com>
-Damien Mathieu <dmathieu@salesforce.com>
-Dan Fredell <furtchet@gmail.com>
-Dan Walsh <dwalsh@redhat.com>
-Daniel Helfand <helfand.4@gmail.com>
 Daniel Huhn <daniel@danielhuhn.de>
-Daniel Menet <membership@sontags.ch>
-Daniel Mizyrycki <mzdaniel@glidelink.net>
-Daniel Nephin <dnephin@gmail.com>
-Daniel, Dao Quang Minh <dqminh89@gmail.com>
-Danila Fominykh <dancheg97@fmnx.su>
 Darren Shepherd <darren@rancher.com>
-Dave <david.warshaw@gmail.com>
 Dave Trombley <dave.trombley@gmail.com>
 Dave Tucker <dt@docker.com>
-David Calavera <david.calavera@gmail.com>
-David Justice <david@devigned.com>
-David Karlsson <david.karlsson@docker.com>
 David Lawrence <david.lawrence@docker.com>
-David Luu <david@davidluu.info>
-David Mackey <tdmackey@booleanhaiku.com>
-David van der Spek <vanderspek.david@gmail.com>
 David Verhasselt <david@crowdway.com>
-David Wu <dwu7401@gmail.com>
 David Xia <dxia@spotify.com>
-Dawn W Docker <dawn.wood@users.noreply.github.com>
-ddelange <14880945+ddelange@users.noreply.github.com>
+davidli <wenquan.li@hp.com>
 Dejan Golja <dejan@golja.org>
-Denis Andrejew <da.colonel@gmail.com>
-dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-Derek <crq@kernel.org>
-Derek McGowan <derek@mcg.dev>
-Deshi Xiao <xiaods@gmail.com>
-Dimitar Kostadinov <dimitar.kostadinov@sap.com>
+Derek McGowan <derek@mcgstyle.net>
 Diogo Mónica <diogo.monica@gmail.com>
 DJ Enriquez <dj.enriquez@infospace.com>
-Djibril Koné <kone.djibril@gmail.com>
-dmp <dmp@loaner.local>
-Don Bowman <don@agilicus.com>
-Don Kjer <don.kjer@gmail.com>
 Donald Huang <don.hcd@gmail.com>
 Doug Davis <dug@us.ibm.com>
-drornir <drornir@users.noreply.github.com>
-duanhongyi <duanhongyi@doopai.com>
-ducksecops <daniel@ducksecops.uk>
-E. M. Bray <erik.m.bray@gmail.com>
-Edgar Lee <edgar.lee@docker.com>
-Elliot Pahl <elliot.pahl@gmail.com>
-elsanli(李楠) <elsanli@tencent.com>
-Elton Stoneman <elton@sixeyed.com>
-Emmanuel Briney <emmanuel.briney@docker.com>
-Eng Zer Jun <engzerjun@gmail.com>
-Eohyung Lee <liquidnuker@gmail.com>
 Eric Yang <windfarer@gmail.com>
-Erica Windisch <erica@windisch.us>
-Erik Hollensbe <github@hollensbe.org>
-Etki <etki@etki.me>
-Eugene Lubarsky <eug48@users.noreply.github.com>
-eyjhb <eyjhbb@gmail.com>
-eyjhbb@gmail.com <eyjhbb@gmail.com>
-Fabio Berchtold <jamesclonk@jamesclonk.ch>
-Fabio Falci <fabiofalci@gmail.com>
-Fabio Huser <fabio@fh1.ch>
 farmerworking <farmerworking@gmail.com>
-fate-grand-order <chenjg@harmonycloud.cn>
-Felix Bünemann <buenemann@louis.info>
 Felix Yan <felixonmars@archlinux.org>
-Feng Honglin <tifayuki@gmail.com>
-Fernando Mayo Fernandez <fernando@undefinedlabs.com>
-Flavian Missi <fmissi@redhat.com>
 Florentin Raud <florentin.raud@gmail.com>
-forkbomber <forkbomber@users.noreply.github.com>
-Frank Chen <frankchn@gmail.com>
 Frederick F. Kautz IV <fkautz@alumni.cmu.edu>
-Gabor Nagy <mail@aigeruth.hu>
 gabriell nascimento <gabriell@bluesoft.com.br>
-Gaetan <gdevillele@gmail.com>
-gary schaetz <gary@schaetzkc.com>
-gbarr01 <gwendolynne.barr@docker.com>
-Geoffrey Hausheer <rc2012@pblue.org>
-ghodsizadeh <mehdi.ghodsizadeh@gmail.com>
-Giovanni Toraldo <giovanni.toraldo@eng.it>
-Gladkov Alexey <agladkov@redhat.com>
-Gleb M Borisov <borisov.gleb@gmail.com>
-Gleb Schukin <gschukin@ptsecurity.com>
-glefloch <glfloch@gmail.com>
-Glyn Owen Hanmer <1295698+glynternet@users.noreply.github.com>
-gotgelf <gotgelf@gmail.com>
-Grachev Mikhail <work@mgrachev.com>
-Grant Watters <grant.watters@docker.com>
-Greg Rebholz <gregrebholz@gmail.com>
-Guillaume J. Charmes <charmes.guillaume@gmail.com>
-Guillaume Rose <guillaume.rose@docker.com>
-Gábor Lipták <gliptak@gmail.com>
 harche <p.harshal@gmail.com>
-hasheddan <georgedanielmangum@gmail.com>
-Hayley Swimelar <hswimelar@gmail.com>
-Helen-xie <xieyulin821@harmonycloud.cn>
 Henri Gomez <henri.gomez@gmail.com>
-Honglin Feng <tifayuki@gmail.com>
 Hu Keping <hukeping@huawei.com>
 Hua Wang <wanghua.humble@gmail.com>
 HuKeping <hukeping@huawei.com>
-Huu Nguyen <whoshuu@gmail.com>
-ialidzhikov <i.alidjikov@gmail.com>
 Ian Babrou <ibobrik@gmail.com>
-iasoon <ilion.beyst@gmail.com>
 igayoso <igayoso@gmail.com>
-Igor Dolzhikov <bluesriverz@gmail.com>
-Igor Morozov <igmorv@gmail.com>
-Ihor Dvoretskyi <ihor@linux.com>
-Ilion Beyst <ilion.beyst@gmail.com>
-Ina Panova <ipanova@redhat.com>
-Irene Diez <idiez@redhat.com>
-Ismail Alidzhikov <i.alidjikov@gmail.com>
-Jack Baines <jack.baines@uk.ibm.com>
 Jack Griffin <jackpg14@gmail.com>
-Jacob Atzen <jatzen@gmail.com>
-Jake Moshenko <jake@devtable.com>
-Jakob Ackermann <das7pad@outlook.com>
-Jakub Mikulas <jakub@mikul.as>
-James Findley <jfindley@fastmail.com>
-James Hewitt <james.hewitt@uk.ibm.com>
-James Lal <james@lightsofapollo.com>
 Jason Freidman <jason.freidman@gmail.com>
-Jason Heiss <jheiss@aput.net>
-Javier Palomo Almena <javier.palomo.almena@gmail.com>
-jdolitsky <393494+jdolitsky@users.noreply.github.com>
 Jeff Nickoloff <jeff@allingeek.com>
-Jeffrey van Gogh <jvg@google.com>
-jerae-duffin <83294991+jerae-duffin@users.noreply.github.com>
-Jeremy THERIN <jtherin@scaleway.com>
-Jesse Brown <jabrown85@gmail.com>
-Jesse Haka <haka.jesse@gmail.com>
-Jessica Frazelle <jess@oxide.computer>
-jhaohai <jhaohai@foxmail.com>
+Jessie Frazelle <jessie@docker.com>
 Jianqing Wang <tsing@jianqing.org>
-Jihoon Chung <jihoon@gmail.com>
-Jim Galasyn <jim.galasyn@docker.com>
-Joao Fernandes <joaofnfernandes@gmail.com>
-Joffrey F <joffrey@docker.com>
-Johan Euphrosine <proppy@google.com>
-John Howard <github@lowenna.com>
-John Mulhausen <john@docker.com>
 John Starks <jostarks@microsoft.com>
 Jon Johnson <jonjohnson@google.com>
 Jon Poler <jonathan.poler@apcera.com>
-Jonas Hecht <jonas.hecht@codecentric.de>
 Jonathan Boulle <jonathanboulle@gmail.com>
-Jonathan Lee <jonjohn1232009@gmail.com>
-Jonathan Rudenberg <jonathan@titanous.com>
 Jordan Liggitt <jliggitt@redhat.com>
-Jose D. Gomez R <jose.gomez@suse.com>
-Josh Chorlton <josh.chorlton@docker.com>
-Josh Dolitsky <josh@dolit.ski>
-Josh Hawn <jlhawn@berkeley.edu>
-Josiah Kiehl <jkiehl@riotgames.com>
-Joyce Brum <joycebrumu.u@gmail.com>
-João Pereira <484633+joaodrp@users.noreply.github.com>
-Julien Bordellier <1444415+jstoja@users.noreply.github.com>
+Josh Hawn <josh.hawn@docker.com>
 Julien Fernandez <julien.fernandez@gmail.com>
-Justas Brazauskas <brazauskasjustas@gmail.com>
-Justin Cormack <justin.cormack@docker.com>
-Justin I. Nevill <JustinINevill@users.noreply.github.com>
-Justin Santa Barbara <justin@fathomdb.com>
-kaiwentan <kaiwentan@harmonycloud.cn>
-Ke Xu <leonhartx.k@gmail.com>
 Keerthan Mala <kmala@engineyard.com>
 Kelsey Hightower <kelsey.hightower@gmail.com>
-Ken Cochrane <KenCochrane@gmail.com>
 Kenneth Lim <kennethlimcp@gmail.com>
 Kenny Leung <kleung@google.com>
-Kevin Lin <kevin@kelda.io>
-Kevin Robatel <kevinrob2@gmail.com>
-Kira <me@imkira.com>
-Kirat Singh <kirat.singh@gmail.com>
-L-Hudson <44844738+L-Hudson@users.noreply.github.com>
-Lachlan Cooper <lachlancooper@gmail.com>
-Laura Brehm <laurabrehm@hey.com>
-Lei Jitang <leijitang@huawei.com>
-Lenny Linux <tippexs91@googlemail.com>
-Leonardo Azize Martins <lazize@users.noreply.github.com>
-leonstrand <leonstrand@gmail.com>
 Li Yi <denverdino@gmail.com>
-Liam White <liamwhite@uk.ibm.com>
-libo.huang <huanglibo2010@gmail.com>
-LingFaKe <lingfake@huawei.com>
-Liron Levin <liron@twistlock.com>
-lisong <lisong@cdsunrise.net>
-Littlemoon917 <18084421+Littlemoon917@users.noreply.github.com>
 Liu Hua <sdu.liu@huawei.com>
 liuchang0812 <liuchang0812@gmail.com>
-liyongxin <yxli@alauda.io>
-Lloyd Ramey <lnr0626@gmail.com>
-lostsquirrel <lostsquirreli@hotmail.com>
 Louis Kottmann <louis.kottmann@gmail.com>
-Luca Bruno <lucab@debian.org>
-Lucas França de Oliveira <lucasfdo@palantir.com>
-Lucas Santos <lhs.santoss@gmail.com>
-Luis Lobo Borobia <luislobo@gmail.com>
 Luke Carpenter <x@rubynerd.net>
-Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
-Makoto Oda <truth_jp_4133@yahoo.co.jp>
-mallchin <mallchin@mac.com>
-Manish Tomar <manish.tomar@docker.com>
-Marco Hennings <marco.hennings@freiheit.com>
-Marcus Martins <marcus@docker.com>
-Maria Bermudez <bermudez.mt@gmail.com>
-Mark Sagi-Kazar <mark.sagikazar@gmail.com>
 Mary Anthony <mary@docker.com>
-Masataka Mizukoshi <m.mizukoshi.wakuwaku@gmail.com>
-Matin Rahmanian <itsmatinx@gmail.com>
-MATSUMOTO TAKEAKI <takeaki.matsumoto@linecorp.com>
 Matt Bentley <mbentley@mbentley.net>
 Matt Duch <matt@learnmetrics.com>
-Matt Linville <matt@linville.me>
 Matt Moore <mattmoor@google.com>
 Matt Robenolt <matt@ydekproductions.com>
-Matt Tescher <matthew.tescher@docker.com>
-Matthew Balvanz <matthew.balvanz@workiva.com>
-Matthew Green <greenmr@live.co.uk>
-Matthew Riley <mattdr@google.com>
-Maurice Sotzny <ailuridae@users.noreply.github.com>
-Meaglith Ma <genedna@gmail.com>
-Michael Bonfils <bonfils.michael@protonmail.com>
-Michael Crosby <crosbymichael@gmail.com>
 Michael Prokop <mika@grml.org>
-Michael Vetter <jubalh@iodoru.org>
-Michal Fojtik <mfojtik@redhat.com>
-Michal Gebauer <mishak@mishak.net>
-Michal Guerquin <michalg@allenai.org>
 Michal Minar <miminar@redhat.com>
-Mike Brown <brownwm@us.ibm.com>
-Mike Lundy <mike@fluffypenguin.org>
-Mike Truman <miketruman42@gmail.com>
-Milos Gajdos <milosthegajdos@gmail.com>
 Miquel Sabaté <msabate@suse.com>
-mlmhl <409107750@qq.com>
-Monika Katiyar <monika@jeavio.com>
 Morgan Bauer <mbauer@us.ibm.com>
 moxiegirl <mary@docker.com>
-mqliang <mqliang.zju@gmail.com>
-Muesli <solom.emmanuel@gmail.com>
-Nan Monnand Deng <monnand@gmail.com>
-Nat Zimmermann <ntzm@users.noreply.github.com>
 Nathan Sullivan <nathan@nightsys.net>
-Naveed Jamil <naveed.jamil@tenpearl.com>
-Neil Wilson <neil@aldur.co.uk>
 nevermosby <robolwq@qq.com>
 Nghia Tran <tcnghia@gmail.com>
-Nicolas De Loof <nicolas.deloof@gmail.com>
-Nikita Tarasov <nikita@mygento.ru>
-ning xie <andy.xning@gmail.com>
-Nishant Totla <nishanttotla@gmail.com>
-Noah Treuhaft <noah.treuhaft@docker.com>
-Novak Ivanovski <novakivanovski@gmail.com>
 Nuutti Kotivuori <nuutti.kotivuori@poplatek.fi>
-Nycholas de Oliveira e Oliveira <nycholas@gmail.com>
 Oilbeater <liumengxinfly@gmail.com>
-Oleg Bulatov <oleg@bulatov.me>
-olegburov <oleg.burov@outlook.com>
-Olivier <o+github@gambier.email>
 Olivier Gambier <olivier@docker.com>
 Olivier Jacques <olivier.jacques@hp.com>
-ollypom <oppomeroy@gmail.com>
 Omer Cohen <git@omer.io>
-Oscar Caballero <ocaballero@opensistemas.com>
-Owen W. Taylor <otaylor@fishsoup.net>
-paigehargrave <Paige.hargrave@docker.com>
-Parth Mehrotra <parth@mehrotra.me>
-Pascal Borreli <pascal@borreli.com>
 Patrick Devine <patrick.devine@docker.com>
-Patrick Easters <peasters@redhat.com>
-Paul Cacheux <paul.cacheux@datadoghq.com>
-Pavel Antonov <ddc67cd@gmail.com>
-Paweł Gronowski <pawel.gronowski@docker.com>
-Per Lundberg <perlun@gmail.com>
-Peter Choi <reikani@Peters-MacBook-Pro.local>
-Peter Dave Hello <hsu@peterdavehello.org>
-Peter Kokot <peterkokot@gmail.com>
-Phil Estes <estesp@gmail.com>
 Philip Misiowiec <philip@atlashealth.com>
-Pierre-Yves Ritschard <pyr@spootnik.org>
-Pieter Scheffers <pieter.scheffers@gmail.com>
-Qiang Huang <h.huangqiang@huawei.com>
-Qiao Anran <qiaoanran@gmail.com>
-Radon Rosborough <radon.neon@gmail.com>
-Randy Barlow <randy@electronsweatshop.com>
-Raphaël Enrici <raphael@root-42.com>
-Ricardo Maraschini <ricardo.maraschini@gmail.com>
-Richard Scothern <richard.scothern@gmail.com>
-Rick Wieman <git@rickw.nl>
-Rik Nijessen <rik@keefo.nl>
-Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
-Rober Morales-Chaparro <rober.morales@rstor.io>
-Robert Kaussow <mail@geeklabor.de>
-Robert Steward <speaktorob@users.noreply.github.com>
-Roberto G. Hashioka <roberto.hashioka@docker.com>
+Richard Scothern <richard.scothern@docker.com>
 Rodolfo Carvalho <rhcarvalho@gmail.com>
-ROY <qqbuby@gmail.com>
-Rui Cao <ruicao@alauda.io>
-ruicao <ruicao@alauda.io>
 Rusty Conover <rusty@luckydinosaur.com>
-Ryan Abrams <rdabrams@gmail.com>
-Ryan Thomas <rthomas@atlassian.com>
-sakeven <jc5930@sina.cn>
-Sam Alba <sam.alba@gmail.com>
-Samuel Karp <skarp@amazon.com>
-sangluo <sangluo@pinduoduo.com>
-Santiago Torres <torresariass@gmail.com>
-Sargun Dhillon <sargun@sargun.me>
-sayboras <sayboras@yahoo.com>
 Sean Boran <Boran@users.noreply.github.com>
-Sean P. Kane <spkane00@gmail.com>
 Sebastiaan van Stijn <github@gone.nl>
-Sebastien Coavoux <s.coavoux@free.fr>
-Serge Dubrouski <sergeyfd@gmail.com>
-Sevki Hasirci <sevki@cloudflare.com>
 Sharif Nassar <sharif@mrwacky.com>
-Shawn Chen <chen8132@gmail.com>
 Shawn Falkner-Horine <dreadpirateshawn@gmail.com>
-Shawnpku <chen8132@gmail.com>
-Shengjing Zhu <zhsj@debian.org>
-Shiela M Parker <smp13@live.com>
-Shishir Mahajan <shishir.mahajan@redhat.com>
 Shreyas Karnik <karnik.shreyas@gmail.com>
-Silvin Lubecki <31478878+silvin-lubecki@users.noreply.github.com>
-Simon <crydotsnakegithub@gmail.com>
 Simon Thulbourn <simon+github@thulbourn.com>
-Simone Locci <simone.locci@eng.it>
-Smasherr <soundcracker@gmail.com>
-Solomon Hykes <solomon@dagger.io>
-Sora Morimoto <sora@morimoto.io>
-spacexnice <yaoyao.xyy@alibaba-inc.com>
 Spencer Rinehart <anubis@overthemonkey.com>
-srajmane <31947381+srajmane@users.noreply.github.com>
-Srini Brahmaroutu <srbrahma@us.ibm.com>
-Stan Hu <stanhu@gmail.com>
-Stefan Lörwald <10850250+stefanloerwald@users.noreply.github.com>
 Stefan Majewsky <stefan.majewsky@sap.com>
-Stefan Nica <snica@suse.com>
 Stefan Weil <sw@weilnetz.de>
-Stephen Day <stevvooe@gmail.com>
-Steve Lasker <stevenlasker@hotmail.com>
-Steven Hanna <stevenhanna6@gmail.com>
-Steven Kalt <SKalt@users.noreply.github.com>
-Steven Taylor <steven.taylor@me.com>
-stonezdj <stonezdj@gmail.com>
-sun jian <cnhttpd@gmail.com>
+Stephen J Day <stephen.day@docker.com>
 Sungho Moon <sungho.moon@navercorp.com>
 Sven Dowideit <SvenDowideit@home.org.au>
 Sylvain Baubeau <sbaubeau@redhat.com>
-syntaxkim <40621244+syntaxkim@users.noreply.github.com>
-T N <tnir@users.noreply.github.com>
-t-eimizu <t-eimizu@aim.ac>
-Tariq Ibrahim <tariq181290@gmail.com>
-TaylorKanper <tony_kanper@hotmail.com>
 Ted Reed <ted.reed@gmail.com>
-Terin Stock <terinjokes@gmail.com>
 tgic <farmer1992@gmail.com>
-Thomas Berger <loki@lokis-chaos.de>
 Thomas Sjögren <konstruktoid@users.noreply.github.com>
 Tianon Gravi <admwiggin@gmail.com>
 Tibor Vass <teabee89@gmail.com>
-tifayuki <tifayuki@gmail.com>
-Tiger Kaovilai <tkaovila@redhat.com>
-Tobias Fuhrimann <mastertinner@users.noreply.github.com>
-Tobias Schwab <tobias.schwab@dynport.de>
-Tom Hayward <thayward@infoblox.com>
-Tom Hu <tomhu1096@gmail.com>
 Tonis Tiigi <tonistiigi@gmail.com>
 Tony Holdstock-Brown <tony@docker.com>
-Tosone <i@tosone.cn>
-Trapier Marshall <trapier@users.noreply.github.com>
 Trevor Pounds <trevor.pounds@gmail.com>
-Trevor Wood <Trevor.G.Wood@gmail.com>
 Troels Thomsen <troels@thomsen.io>
-uhayate <uhayate.gong@daocloud.io>
-Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
-Usha Mandya <usha.mandya@docker.com>
-Vaidas Jablonskis <jablonskis@gmail.com>
-Vega Chou <VegeChou@users.noreply.github.com>
-Veres Lajos <vlajos@gmail.com>
-Victor Vieux <victorvieux@gmail.com>
-Victoria Bialas <victoria.bialas@docker.com>
-Vidar <vl@ez.no>
-Viktor Stanchev <me@viktorstanchev.com>
 Vincent Batts <vbatts@redhat.com>
-Vincent Demeester <vincent.demeester@docker.com>
-Vincent Giersch <vincent@giersch.fr>
-Vishesh Jindal <vishesh92@gmail.com>
+Vincent Demeester <vincent@sbr.pm>
+Vincent Giersch <vincent.giersch@ovh.net>
 W. Trevor King <wking@tremily.us>
-Wang Jie <wangjie5@chinaskycloud.com>
-Wang Yan <wangyan@vmware.com>
-Wassim Dhif <wassimdhif@gmail.com>
-wayne <wayne.warren.s@gmail.com>
-Wei Fu <fuweid89@gmail.com>
-Wei Meng <wemeng@microsoft.com>
 weiyuan.yl <weiyuan.yl@alibaba-inc.com>
-Wen-Quan Li <legendarilylwq@gmail.com>
-Wenkai Yin <yinw@vmware.com>
-william wei <1342247033@qq.com>
 xg.song <xg.song@venusource.com>
 xiekeyang <xiekeyang@huawei.com>
-Xueshan Feng <xueshan.feng@gmail.com>
 Yann ROBERT <yann.robert@anantaplex.fr>
-Yannick Fricke <YannickFricke@users.noreply.github.com>
-yaoyao.xyy <yaoyao.xyy@alibaba-inc.com>
-yixi zhang <yixi@memsql.com>
-Yong Tang <yong.tang.github@outlook.com>
-Yong Wen Chua <lawliet89@users.noreply.github.com>
-Yongxin Li <yxli@alauda.io>
-Yu Wang <yuwa@microsoft.com>
-yuexiao-wang <wang.yuexiao@zte.com.cn>
-YuJie <390282283@qq.com>
 yuzou <zouyu7@huawei.com>
-Zhang Wei <zhangwei555@huawei.com>
-zhipengzuo <zuozhipeng@baidu.com>
-zhouhaibing089 <zhouhaibing089@gmail.com>
-zounengren <zounengren@cmss.chinamobile.com>
 姜继忠 <jizhong.jiangjz@alibaba-inc.com>

BUILDING.md

@@ -1,129 +0,0 @@
-
-# Building the registry source
-
-## Use-case
-
-This is useful if you intend to actively work on the registry.
-
-### Alternatives
-
-Most people should use prebuilt images, for example, the [Registry docker image](https://hub.docker.com/r/library/registry/) provided by Docker.
-
-People looking for advanced operational use cases might consider rolling their own image with a custom Dockerfile inheriting `FROM registry:2`.
-
-The latest updates to `main` branch are automatically pushed to [distribution Docker Hub repository](https://hub.docker.com/r/distribution/distribution) and tagged with `edge` tag.
-
-### Gotchas
-
-You are expected to know your way around with `go` & `git`.
-
-If you are a casual user with no development experience, and no preliminary knowledge of Go, building from source is probably not a good solution for you.
-
-## Configure the development environment
-
-The first prerequisite of properly building distribution targets is to have a Go
-development environment setup. Please follow [How to Write Go Code](https://go.dev/doc/code) for proper setup.
-
-Next, fetch the code from the repository using git:
-
-    git clone https://github.com/distribution/distribution
-    cd distribution
-
-If you are planning to create a pull request with changes, you may want to clone directly from your [fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/about-forks).
-
-## Build and run from source
-
-First, build the binaries:
-
-    $ make
-    + bin/registry
-    + bin/digest
-    + bin/registry-api-descriptor-template
-    + binaries
-
-Now create the directory for the registry data (this might require you to set permissions properly)
-
-    mkdir -p /var/lib/registry
-
-... or alternatively `export REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/somewhere` if you want to store data into another location.
-
-The `registry`
-binary can then be run with the following:
-
-    $ ./bin/registry --version
-    ./bin/registry github.com/distribution/distribution/v3 v2.7.0-1993-g8857a194
-
-The registry can be run with a development config using the following
-incantation:
-
-    $ ./bin/registry serve cmd/registry/config-dev.yml
-    INFO[0000] debug server listening :5001
-    WARN[0000] No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable.  environment=development go.version=go1.18.3 instance.id=e837df62-a66c-4e04-a014-b063546e82e0 service=registry version=v2.7.0-1993-g8857a194
-    INFO[0000] endpoint local-5003 disabled, skipping        environment=development go.version=go1.18.3 instance.id=e837df62-a66c-4e04-a014-b063546e82e0 service=registry version=v2.7.0-1993-g8857a194
-    INFO[0000] endpoint local-8083 disabled, skipping        environment=development go.version=go1.18.3 instance.id=e837df62-a66c-4e04-a014-b063546e82e0 service=registry version=v2.7.0-1993-g8857a194
-    INFO[0000] using inmemory blob descriptor cache          environment=development go.version=go1.18.3 instance.id=e837df62-a66c-4e04-a014-b063546e82e0 service=registry version=v2.7.0-1993-g8857a194
-    INFO[0000] providing prometheus metrics on /metrics
-    INFO[0000] listening on [::]:5000                        environment=development go.version=go1.18.3 instance.id=e837df62-a66c-4e04-a014-b063546e82e0 service=registry version=v2.7.0-1993-g8857a194
-
-If it is working, one should see the above log messages.
-
-### Build reference
-
-The regular `go` commands, such as `go test`, should work per package.
-
-A `Makefile` has been provided as a convenience to support repeatable builds.
-
-Run `make` to build the binaries:
-
-    $ make
-    + bin/registry
-    + bin/digest
-    + bin/registry-api-descriptor-template
-    + binaries
-
-The above provides a repeatable build using the contents of the vendor
-directory. We can verify this worked by running
-the registry binary generated in the "./bin" directory:
-
-    $ ./bin/registry --version
-    ./bin/registry github.com/distribution/distribution v2.0.0-alpha.2-80-g16d8b2c.m
-
-Run `make test` to run all of the tests.
-
-Run `make validate` to run the validators, including the linter and vendor validation. You must have docker with the buildx plugin installed to run the validators.
-
-### Optional build tags
-
-Optional [build tags](http://golang.org/pkg/go/build/) can be provided using
-the environment variable `BUILDTAGS`.
-
-<dl>
-<dt>noresumabledigest</dt>
-<dd>Compiles without resumable digest support</dd>
-</dl>
-
-### Local cloud storage environment
-
-You can run an S3 API compatible storage locally with [minio](https://min.io/).
-
-You must have a [docker compose](https://docs.docker.com/compose/) compatible tool installed on your workstation.
-
-Start the local cloud environment:
-```
-make start-cloud-storage
-```
-There is a sample registry configuration file that lets you point the registry to the started storage:
-```
-AWS_ACCESS_KEY=distribution \
-        AWS_SECRET_KEY=password \
-        AWS_REGION=us-east-1 \
-        S3_BUCKET=images-local \
-        S3_ENCRYPT=false \
-        REGION_ENDPOINT=http://127.0.0.1:9000 \
-        S3_SECURE=false \
-./bin/registry serve tests/conf-local-cloud.yml
-```
-Stop the local storage when done:
-```
-make stop-cloud-storage
-```

CODE-OF-CONDUCT.md

@@ -1,5 +0,0 @@
-# Code of Conduct
-
-We follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
-
-Please contact the [CNCF Code of Conduct Committee](mailto:conduct@cncf.io) in order to report violations of the Code of Conduct.

CONTRIBUTING.md

@@ -1,15 +1,14 @@
 # Contributing to the registry
 
-## Before reporting an issue...
+## Before reporting an issue...
 
 ### If your problem is with...
 
- - automated builds or your [Docker Hub](https://hub.docker.com/) account
-   - Report it to [Hub Support](https://hub.docker.com/support/)
- - Distributions of Docker for desktop or Linux
-    - Report [Mac Desktop issues](https://github.com/docker/for-mac)
-    - Report [Windows Desktop issues](https://github.com/docker/for-win)
-    - Report [Linux issues](https://github.com/docker/for-linux)
+ - automated builds
+ - your account on the [Docker Hub](https://hub.docker.com/)
+ - any other [Docker Hub](https://hub.docker.com/) issue
+
+Then please do not report your issue here - you should instead report it to [https://support.docker.com](https://support.docker.com)
 
 ### If you...
 
@@ -17,16 +16,10 @@
  - can't figure out something
  - are not sure what's going on or what your problem is
 
-Please ask first in the [#distribution](https://cloud-native.slack.com/archives/C01GVR8SY4R) channel on CNCF community slack.
-[Click here for an invite to the CNCF community slack](https://slack.cncf.io/)
+Then please do not open an issue here yet - you should first try one of the following support forums:
 
-### Reporting security issues
-
-The maintainers take security seriously. If you discover a security
-issue, please bring it to their attention right away!
-
-Please **DO NOT** file a public issue, instead send your report privately to
-[cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io).
+ - irc: #docker-distribution on freenode
+ - mailing-list: <distribution@dockerproject.org> or https://groups.google.com/a/dockerproject.org/forum/#!forum/distribution
 
 ## Reporting an issue properly
 
@@ -34,7 +27,7 @@ By following these simple rules you will get better and faster feedback on your
 
  - search the bugtracker for an already reported issue
 
-### If you found an issue that describes your problem:
+### If you found an issue that describes your problem:
 
  - please read other user comments first, and confirm this is the same issue: a given error condition might be indicative of different problems - you may also find a workaround in the comments
  - please refrain from adding "same thing here" or "+1" comments
@@ -47,10 +40,10 @@ By following these simple rules you will get better and faster feedback on your
  1. create a new issue, with a succinct title that describes your issue:
    - bad title: "It doesn't work with my docker"
    - good title: "Private registry push fail: 400 error with E_INVALID_DIGEST"
- 2. copy the output of (or similar for other container tools):
+ 2. copy the output of:
    - `docker version`
    - `docker info`
-   - `docker exec <registry-container> registry --version`
+   - `docker exec <registry-container> registry -version`
  3. copy the command line you used to launch your Registry
  4. restart your docker daemon in debug mode (add `-D` to the daemon launch arguments)
  5. reproduce your problem and get your docker daemon logs showing the error
@@ -58,72 +51,90 @@ By following these simple rules you will get better and faster feedback on your
  7. provide any relevant detail about your specific Registry configuration (e.g., storage backend used)
  8. indicate if you are using an enterprise proxy, Nginx, or anything else between you and your Registry
 
-## Contributing Code
-
-Contributions should be made via pull requests. Pull requests will be reviewed
-by one or more maintainers or reviewers and merged when acceptable.
+## Contributing a patch for a known bug, or a small correction
 
 You should follow the basic GitHub workflow:
 
- 1. Use your own [fork](https://help.github.com/en/articles/about-forks)
- 2. Create your [change](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#successful-changes)
- 3. Test your code
- 4. [Commit](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#commit-messages) your work, always [sign your commits](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#commit-messages)
- 5. Push your change to your fork and create a [Pull Request](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork)
+ 1. fork
+ 2. commit a change
+ 3. make sure the tests pass
+ 4. PR
 
-Refer to [containerd's contribution guide](https://github.com/containerd/project/blob/master/CONTRIBUTING.md#successful-changes)
-for tips on creating a successful contribution.
+Additionally, you must [sign your commits](https://github.com/docker/docker/blob/master/CONTRIBUTING.md#sign-your-work). It's very simple:
 
-## Sign your work
+ - configure your name with git: `git config user.name "Real Name" && git config user.email mail@example.com`
+ - sign your commits using `-s`: `git commit -s -m "My commit"`
 
-The sign-off is a simple line at the end of the explanation for the patch. Your
-signature certifies that you wrote the patch or otherwise have the right to pass
-it on as an open-source patch. The rules are pretty simple: if you can certify
-the below (from [developercertificate.org](http://developercertificate.org/)):
+Some simple rules to ensure quick merge:
 
-```
-Developer Certificate of Origin
-Version 1.1
+ - clearly point to the issue(s) you want to fix in your PR comment (e.g., `closes #12345`)
+ - prefer multiple (smaller) PRs addressing individual issues over a big one trying to address multiple issues at once
+ - if you need to amend your PR following comments, please squash instead of adding more commits
 
-Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
+## Contributing new features
 
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
+You are heavily encouraged to first discuss what you want to do. You can do so on the irc channel, or by opening an issue that clearly describes the use case you want to fulfill, or the problem you are trying to solve.
 
-Developer's Certificate of Origin 1.1
+If this is a major new feature, you should then submit a proposal that describes your technical solution and reasoning.
+If you did discuss it first, this will likely be greenlighted very fast. It's advisable to address all feedback on this proposal before starting actual work.
 
-By making a contribution to this project, I certify that:
+Then you should submit your implementation, clearly linking to the issue (and possible proposal).
 
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
+Your PR will be reviewed by the community, then ultimately by the project maintainers, before being merged.
 
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
+It's mandatory to:
 
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
+ - interact respectfully with other community members and maintainers - more generally, you are expected to abide by the [Docker community rules](https://github.com/docker/docker/blob/master/CONTRIBUTING.md#docker-community-guidelines)
+ - address maintainers' comments and modify your submission accordingly
+ - write tests for any new code
 
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
-```
+Complying to these simple rules will greatly accelerate the review process, and will ensure you have a pleasant experience in contributing code to the Registry.
 
-Then you just add a line to every git commit message:
+Have a look at a great, successful contribution: the [Swift driver PR](https://github.com/docker/distribution/pull/493)
 
-    Signed-off-by: Joe Smith <joe.smith@email.com>
+## Coding Style
 
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
+Unless explicitly stated, we follow all coding guidelines from the Go
+community. While some of these standards may seem arbitrary, they somehow seem
+to result in a solid, consistent codebase.
 
-If you set your `user.name` and `user.email` git configs, you can sign your
-commit automatically with `git commit -s`.
+It is possible that the code base does not currently comply with these
+guidelines. We are not looking for a massive PR that fixes this, since that
+goes against the spirit of the guidelines. All new contributions should make a
+best effort to clean up and make the code base better than they left it.
+Obviously, apply your best judgement. Remember, the goal here is to make the
+code base easier for humans to navigate and understand. Always keep that in
+mind when nudging others to comply.
+
+The rules:
+
+1. All code should be formatted with `gofmt -s`.
+2. All code should pass the default levels of
+   [`golint`](https://github.com/golang/lint).
+3. All code should follow the guidelines covered in [Effective
+   Go](http://golang.org/doc/effective_go.html) and [Go Code Review
+   Comments](https://github.com/golang/go/wiki/CodeReviewComments).
+4. Comment the code. Tell us the why, the history and the context.
+5. Document _all_ declarations and methods, even private ones. Declare
+   expectations, caveats and anything else that may be important. If a type
+   gets exported, having the comments already there will ensure it's ready.
+6. Variable name length should be proportional to its context and no longer.
+   `noCommaALongVariableNameLikeThisIsNotMoreClearWhenASimpleCommentWouldDo`.
+   In practice, short methods will have short variable names and globals will
+   have longer names.
+7. No underscores in package names. If you need a compound name, step back,
+   and re-examine why you need a compound name. If you still think you need a
+   compound name, lose the underscore.
+8. No utils or helpers packages. If a function is not general enough to
+   warrant its own package, it has not been written generally enough to be a
+   part of a util package. Just leave it unexported and well-documented.
+9. All tests should run with `go test` and outside tooling should not be
+   required. No, we don't need another unit testing framework. Assertion
+   packages are acceptable if they provide _real_ incremental value.
+10. Even though we call these "rules" above, they are actually just
+    guidelines. Since you've read all the rules, you now know that.
+
+If you are having trouble getting into the mood of idiomatic Go, we recommend
+reading through [Effective Go](http://golang.org/doc/effective_go.html). The
+[Go Blog](http://blog.golang.org/) is also a great resource. Drinking the
+kool-aid is a lot easier than going thirsty.

Dockerfile

@@ -1,60 +1,18 @@
-# syntax=docker/dockerfile:1
+FROM golang:1.6
 
-ARG GO_VERSION=1.22.4
-ARG ALPINE_VERSION=3.20
-ARG XX_VERSION=1.2.1
+RUN apt-get update && \
+    apt-get install -y apache2-utils && \
+    rm -rf /var/lib/apt/lists/*
 
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
-COPY --from=xx / /
-RUN apk add --no-cache bash coreutils file git
-ENV GO111MODULE=auto
-ENV CGO_ENABLED=0
-WORKDIR /src
+ENV DISTRIBUTION_DIR /go/src/github.com/docker/distribution
+ENV DOCKER_BUILDTAGS include_oss include_gcs
 
-FROM base AS version
-ARG PKG=github.com/distribution/distribution/v3
-RUN --mount=target=. \
-  VERSION=$(git describe --match 'v[0-9]*' --dirty='.m' --always --tags) REVISION=$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi); \
-  echo "-X ${PKG}/version.version=${VERSION#v} -X ${PKG}/version.revision=${REVISION} -X ${PKG}/version.mainpkg=${PKG}" | tee /tmp/.ldflags; \
-  echo -n "${VERSION}" | tee /tmp/.version;
+WORKDIR $DISTRIBUTION_DIR
+COPY . $DISTRIBUTION_DIR
+COPY cmd/registry/config-dev.yml /etc/docker/registry/config.yml
+RUN make PREFIX=/go clean binaries
 
-FROM base AS build
-ARG TARGETPLATFORM
-ARG LDFLAGS="-s -w"
-ARG BUILDTAGS=""
-RUN --mount=type=bind,target=/src \
-    --mount=type=cache,target=/root/.cache/go-build \
-    --mount=target=/go/pkg/mod,type=cache \
-    --mount=type=bind,source=/tmp/.ldflags,target=/tmp/.ldflags,from=version \
-      set -x ; xx-go build -tags "${BUILDTAGS}" -trimpath -ldflags "$(cat /tmp/.ldflags) ${LDFLAGS}" -o /usr/bin/registry ./cmd/registry \
-      && xx-verify --static /usr/bin/registry
-
-FROM scratch AS binary
-COPY --from=build /usr/bin/registry /
-
-FROM base AS releaser
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT
-WORKDIR /work
-RUN --mount=from=binary,target=/build \
-    --mount=type=bind,target=/src \
-    --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
-      VERSION=$(cat /tmp/.version) \
-      && mkdir -p /out \
-      && cp /build/registry /src/README.md /src/LICENSE . \
-      && tar -czvf "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz" * \
-      && sha256sum -z "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz" | awk '{ print $1 }' > "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.gz.sha256"
-
-FROM scratch AS artifact
-COPY --from=releaser /out /
-
-FROM alpine:${ALPINE_VERSION}
-RUN apk add --no-cache ca-certificates
-COPY cmd/registry/config-dev.yml /etc/distribution/config.yml
-COPY --from=binary /registry /bin/registry
 VOLUME ["/var/lib/registry"]
 EXPOSE 5000
 ENTRYPOINT ["registry"]
-CMD ["serve", "/etc/distribution/config.yml"]
+CMD ["serve", "/etc/docker/registry/config.yml"]

GOVERNANCE.md

@@ -1,144 +0,0 @@
-# distribution/distribution Project Governance
-
-Distribution [Code of Conduct](./CODE-OF-CONDUCT.md) can be found here.
-
-For specific guidance on practical contribution steps please
-see our [CONTRIBUTING.md](./CONTRIBUTING.md) guide.
-
-## Maintainership
-
-There are different types of maintainers, with different responsibilities, but
-all maintainers have 3 things in common:
-
-1) They share responsibility in the project's success.
-2) They have made a long-term, recurring time investment to improve the project.
-3) They spend that time doing whatever needs to be done, not necessarily what
-is the most interesting or fun.
-
-Maintainers are often under-appreciated, because their work is harder to appreciate.
-It's easy to appreciate a really cool and technically advanced feature. It's harder
-to appreciate the absence of bugs, the slow but steady improvement in stability,
-or the reliability of a release process. But those things distinguish a good
-project from a great one.
-
-## Reviewers
-
-A reviewer is a core role within the project.
-They share in reviewing issues and pull requests and their LGTM counts towards the
-required LGTM count to merge a code change into the project.
-
-Reviewers are part of the organization but do not have write access.
-Becoming a reviewer is a core aspect in the journey to becoming a maintainer.
-
-## Adding maintainers
-
-Maintainers are first and foremost contributors that have shown they are
-committed to the long term success of a project. Contributors wanting to become
-maintainers are expected to be deeply involved in contributing code, pull
-request review, and triage of issues in the project for more than three months.
-
-Just contributing does not make you a maintainer, it is about building trust
-with the current maintainers of the project and being a person that they can
-depend on and trust to make decisions in the best interest of the project.
-
-Periodically, the existing maintainers curate a list of contributors that have
-shown regular activity on the project over the prior months. From this list,
-maintainer candidates are selected and proposed in a pull request or a
-maintainers communication channel.
-
-After a candidate has been announced to the maintainers, the existing
-maintainers are given five business days to discuss the candidate, raise
-objections and cast their vote. Votes may take place on the communication
-channel or via pull request comment. Candidates must be approved by at least 66%
-of the current maintainers by adding their vote on the mailing list. The
-reviewer role has the same process but only requires 33% of current maintainers.
-Only maintainers of the repository that the candidate is proposed for are
-allowed to vote.
-
-If a candidate is approved, a maintainer will contact the candidate to invite
-the candidate to open a pull request that adds the contributor to the
-MAINTAINERS file. The voting process may take place inside a pull request if a
-maintainer has already discussed the candidacy with the candidate and a
-maintainer is willing to be a sponsor by opening the pull request. The candidate
-becomes a maintainer once the pull request is merged.
-
-## Stepping down policy
-
-Life priorities, interests, and passions can change. If you're a maintainer but
-feel you must remove yourself from the list, inform other maintainers that you
-intend to step down, and if possible, help find someone to pick up your work.
-At the very least, ensure your work can be continued where you left off.
-
-After you've informed other maintainers, create a pull request to remove
-yourself from the MAINTAINERS file.
-
-## Removal of inactive maintainers
-
-Similar to the procedure for adding new maintainers, existing maintainers can
-be removed from the list if they do not show significant activity on the
-project. Periodically, the maintainers review the list of maintainers and their
-activity over the last three months.
-
-If a maintainer has shown insufficient activity over this period, a neutral
-person will contact the maintainer to ask if they want to continue being
-a maintainer. If the maintainer decides to step down as a maintainer, they
-open a pull request to be removed from the MAINTAINERS file.
-
-If the maintainer wants to remain a maintainer, but is unable to perform the
-required duties they can be removed with a vote of at least 66% of the current
-maintainers. In this case, maintainers should first propose the change to
-maintainers via the maintainers communication channel, then open a pull request
-for voting. The voting period is five business days. The voting pull request
-should not come as a surpise to any maintainer and any discussion related to
-performance must not be discussed on the pull request.
-
-## How are decisions made?
-
-CNCF distribution is an open-source project with an open design philosophy.
-This means that the repository is the source of truth for EVERY aspect of the
-project, including its philosophy, design, road map, and APIs. *If it's part of
-the project, it's in the repo. If it's in the repo, it's part of the project.*
-
-As a result, all decisions can be expressed as changes to the repository. An
-implementation change is a change to the source code. An API change is a change
-to the API specification. A philosophy change is a change to the philosophy
-manifesto, and so on.
-
-All decisions affecting distribution, big and small, follow the same 3 steps:
-
-* Step 1: Open a pull request. Anyone can do this.
-
-* Step 2: Discuss the pull request. Anyone can do this.
-
-* Step 3: Merge or refuse the pull request. Who does this depends on the nature
-of the pull request and which areas of the project it affects.
-
-## Helping contributors with the DCO
-
-The [DCO or `Sign your work`](./CONTRIBUTING.md#sign-your-work)
-requirement is not intended as a roadblock or speed bump.
-
-Some contributors are not as familiar with `git`, or have used a web
-based editor, and thus asking them to `git commit --amend -s` is not the best
-way forward.
-
-In this case, maintainers can update the commits based on clause (c) of the DCO.
-The most trivial way for a contributor to allow the maintainer to do this, is to
-add a DCO signature in a pull requests's comment, or a maintainer can simply
-note that the change is sufficiently trivial that it does not substantially
-change the existing contribution - i.e., a spelling change.
-
-When you add someone's DCO, please also add your own to keep a log.
-
-## I'm a maintainer. Should I make pull requests too?
-
-Yes. Nobody should ever push to master directly. All changes should be
-made through a pull request.
-
-## Conflict Resolution
-
-If you have a technical dispute that you feel has reached an impasse with a
-subset of the community, any contributor may open an issue, specifically
-calling for a resolution vote of the current core maintainers to resolve the
-dispute. The same voting quorums required (2/3) for adding and removing
-maintainers will apply to conflict resolution.

Godeps/Godeps.json

@@ -0,0 +1,430 @@
+{
+	"ImportPath": "github.com/docker/distribution",
+	"GoVersion": "go1.6",
+	"GodepVersion": "v60",
+	"Packages": [
+		"./..."
+	],
+	"Deps": [
+		{
+			"ImportPath": "github.com/Azure/azure-sdk-for-go/storage",
+			"Comment": "v1.2-334-g95361a2",
+			"Rev": "95361a2573b1fa92a00c5fc2707a80308483c6f9"
+		},
+		{
+			"ImportPath": "github.com/Sirupsen/logrus",
+			"Comment": "v0.7.3",
+			"Rev": "55eb11d21d2a31a3cc93838241d04800f52e823d"
+		},
+		{
+			"ImportPath": "github.com/Sirupsen/logrus/formatters/logstash",
+			"Comment": "v0.7.3",
+			"Rev": "55eb11d21d2a31a3cc93838241d04800f52e823d"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/awserr",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/awsutil",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/client",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/client/metadata",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/corehandlers",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/credentials",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/defaults",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/ec2metadata",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/request",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/aws/session",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/endpoints",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol/query",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol/query/queryutil",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol/rest",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol/restxml",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/signer/v4",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/private/waiter",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/cloudfront/sign",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/s3",
+			"Comment": "v1.1.0-14-g49c3892",
+			"Rev": "49c3892b61af1d4996292a3025f36e4dfa25eaee"
+		},
+		{
+			"ImportPath": "github.com/bugsnag/bugsnag-go",
+			"Comment": "v1.0.2-5-gb1d1530",
+			"Rev": "b1d153021fcd90ca3f080db36bec96dc690fb274"
+		},
+		{
+			"ImportPath": "github.com/bugsnag/bugsnag-go/errors",
+			"Comment": "v1.0.2-5-gb1d1530",
+			"Rev": "b1d153021fcd90ca3f080db36bec96dc690fb274"
+		},
+		{
+			"ImportPath": "github.com/bugsnag/osext",
+			"Rev": "0dd3f918b21bec95ace9dc86c7e70266cfc5c702"
+		},
+		{
+			"ImportPath": "github.com/bugsnag/panicwrap",
+			"Comment": "1.0.0-2-ge2c2850",
+			"Rev": "e2c28503fcd0675329da73bf48b33404db873782"
+		},
+		{
+			"ImportPath": "github.com/denverdino/aliyungo/common",
+			"Rev": "6ffb587da9da6d029d0ce517b85fecc82172d502"
+		},
+		{
+			"ImportPath": "github.com/denverdino/aliyungo/oss",
+			"Rev": "6ffb587da9da6d029d0ce517b85fecc82172d502"
+		},
+		{
+			"ImportPath": "github.com/denverdino/aliyungo/util",
+			"Rev": "6ffb587da9da6d029d0ce517b85fecc82172d502"
+		},
+		{
+			"ImportPath": "github.com/docker/goamz/aws",
+			"Rev": "f0a21f5b2e12f83a505ecf79b633bb2035cf6f85"
+		},
+		{
+			"ImportPath": "github.com/docker/goamz/s3",
+			"Rev": "f0a21f5b2e12f83a505ecf79b633bb2035cf6f85"
+		},
+		{
+			"ImportPath": "github.com/docker/libtrust",
+			"Rev": "fa567046d9b14f6aa788882a950d69651d230b21"
+		},
+		{
+			"ImportPath": "github.com/garyburd/redigo/internal",
+			"Rev": "535138d7bcd717d6531c701ef5933d98b1866257"
+		},
+		{
+			"ImportPath": "github.com/garyburd/redigo/redis",
+			"Rev": "535138d7bcd717d6531c701ef5933d98b1866257"
+		},
+		{
+			"ImportPath": "github.com/go-ini/ini",
+			"Comment": "v1.8.6",
+			"Rev": "afbd495e5aaea13597b5e14fe514ddeaa4d76fc3"
+		},
+		{
+			"ImportPath": "github.com/golang/protobuf/proto",
+			"Rev": "8d92cf5fc15a4382f8964b08e1f42a75c0591aa3"
+		},
+		{
+			"ImportPath": "github.com/gorilla/context",
+			"Rev": "14f550f51af52180c2eefed15e5fd18d63c0a64a"
+		},
+		{
+			"ImportPath": "github.com/gorilla/handlers",
+			"Rev": "60c7bfde3e33c201519a200a4507a158cc03a17b"
+		},
+		{
+			"ImportPath": "github.com/gorilla/mux",
+			"Rev": "e444e69cbd2e2e3e0749a2f3c717cec491552bbf"
+		},
+		{
+			"ImportPath": "github.com/inconshreveable/mousetrap",
+			"Rev": "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75"
+		},
+		{
+			"ImportPath": "github.com/jmespath/go-jmespath",
+			"Comment": "0.2.2-12-g0b12d6b",
+			"Rev": "0b12d6b521d83fc7f755e7cfc1b1fbdd35a01a74"
+		},
+		{
+			"ImportPath": "github.com/mitchellh/mapstructure",
+			"Rev": "482a9fd5fa83e8c4e7817413b80f3eb8feec03ef"
+		},
+		{
+			"ImportPath": "github.com/ncw/swift",
+			"Rev": "c54732e87b0b283d1baf0a18db689d0aea460ba3"
+		},
+		{
+			"ImportPath": "github.com/ncw/swift/swifttest",
+			"Rev": "c54732e87b0b283d1baf0a18db689d0aea460ba3"
+		},
+		{
+			"ImportPath": "github.com/spf13/cobra",
+			"Rev": "312092086bed4968099259622145a0c9ae280064"
+		},
+		{
+			"ImportPath": "github.com/spf13/pflag",
+			"Rev": "5644820622454e71517561946e3d94b9f9db6842"
+		},
+		{
+			"ImportPath": "github.com/stevvooe/resumable",
+			"Rev": "51ad44105773cafcbe91927f70ac68e1bf78f8b4"
+		},
+		{
+			"ImportPath": "github.com/stevvooe/resumable/sha256",
+			"Rev": "51ad44105773cafcbe91927f70ac68e1bf78f8b4"
+		},
+		{
+			"ImportPath": "github.com/stevvooe/resumable/sha512",
+			"Rev": "51ad44105773cafcbe91927f70ac68e1bf78f8b4"
+		},
+		{
+			"ImportPath": "github.com/yvasiyarov/go-metrics",
+			"Rev": "57bccd1ccd43f94bb17fdd8bf3007059b802f85e"
+		},
+		{
+			"ImportPath": "github.com/yvasiyarov/gorelic",
+			"Comment": "v0.0.6-8-ga9bba5b",
+			"Rev": "a9bba5b9ab508a086f9a12b8c51fab68478e2128"
+		},
+		{
+			"ImportPath": "github.com/yvasiyarov/newrelic_platform_go",
+			"Rev": "b21fdbd4370f3717f3bbd2bf41c223bc273068e6"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/bcrypt",
+			"Rev": "c10c31b5e94b6f7a0283272dc2bb27163dcea24b"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/blowfish",
+			"Rev": "c10c31b5e94b6f7a0283272dc2bb27163dcea24b"
+		},
+		{
+			"ImportPath": "golang.org/x/net/context",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/net/context/ctxhttp",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/net/http2",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/net/http2/hpack",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/net/internal/timeseries",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/net/trace",
+			"Rev": "4876518f9e71663000c348837735820161a42df7"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2",
+			"Rev": "045497edb6234273d67dbc25da3f2ddbc4c4cacf"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2/google",
+			"Rev": "045497edb6234273d67dbc25da3f2ddbc4c4cacf"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2/internal",
+			"Rev": "045497edb6234273d67dbc25da3f2ddbc4c4cacf"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2/jws",
+			"Rev": "045497edb6234273d67dbc25da3f2ddbc4c4cacf"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2/jwt",
+			"Rev": "045497edb6234273d67dbc25da3f2ddbc4c4cacf"
+		},
+		{
+			"ImportPath": "google.golang.org/api/gensupport",
+			"Rev": "9bf6e6e569ff057f75d9604a46c52928f17d2b54"
+		},
+		{
+			"ImportPath": "google.golang.org/api/googleapi",
+			"Rev": "9bf6e6e569ff057f75d9604a46c52928f17d2b54"
+		},
+		{
+			"ImportPath": "google.golang.org/api/googleapi/internal/uritemplates",
+			"Rev": "9bf6e6e569ff057f75d9604a46c52928f17d2b54"
+		},
+		{
+			"ImportPath": "google.golang.org/api/storage/v1",
+			"Rev": "9bf6e6e569ff057f75d9604a46c52928f17d2b54"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/app_identity",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/base",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/datastore",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/log",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/modules",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/appengine/internal/remote_api",
+			"Rev": "12d5545dc1cfa6047a286d5e853841b6471f4c19"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud",
+			"Rev": "975617b05ea8a58727e6c1a06b6161ff4185a9f2"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/compute/metadata",
+			"Rev": "975617b05ea8a58727e6c1a06b6161ff4185a9f2"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/internal",
+			"Rev": "975617b05ea8a58727e6c1a06b6161ff4185a9f2"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/internal/opts",
+			"Rev": "975617b05ea8a58727e6c1a06b6161ff4185a9f2"
+		},
+		{
+			"ImportPath": "google.golang.org/cloud/storage",
+			"Rev": "975617b05ea8a58727e6c1a06b6161ff4185a9f2"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/codes",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/credentials",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/grpclog",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/internal",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/metadata",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/naming",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/peer",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "google.golang.org/grpc/transport",
+			"Rev": "d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994"
+		},
+		{
+			"ImportPath": "gopkg.in/check.v1",
+			"Rev": "64131543e7896d5bcc6bd5a76287eb75ea96c673"
+		},
+		{
+			"ImportPath": "gopkg.in/yaml.v2",
+			"Rev": "bef53efd0c76e49e6de55ead051f886bea7e9420"
+		}
+	]
+}

Godeps/Readme

@@ -0,0 +1,5 @@
+This directory tree is generated automatically by godep.
+
+Please do not edit.
+
+See https://github.com/tools/godep for more information.

MAINTAINERS

@@ -1,26 +1,63 @@
-# Distribution project maintainers & reviewers
+# Distribution maintainers file
 #
-# See GOVERNANCE.md for maintainer versus reviewer roles
+# This file describes who runs the docker/distribution project and how.
+# This is a living document - if you see something out of date or missing, speak up!
 #
-# MAINTAINERS (cncf-distribution-maintainers@lists.cncf.io)
-# GitHub ID, Name, Email address
-"chrispat","Chris Patterson","chrispat@github.com"
-"clarkbw","Bryan Clark","clarkbw@github.com"
-"corhere","Cory Snider","csnider@mirantis.com"
-"deleteriousEffect","Hayley Swimelar","hswimelar@gitlab.com"
-"heww","He Weiwei","hweiwei@vmware.com"
-"joaodrp","João Pereira","jpereira@gitlab.com"
-"justincormack","Justin Cormack","justin.cormack@docker.com"
-"squizzi","Kyle Squizzato","ksquizzato@mirantis.com"
-"milosgajdos","Milos Gajdos","milosthegajdos@gmail.com"
-"sargun","Sargun Dhillon","sargun@sargun.me"
-"wy65701436","Wang Yan","wangyan@vmware.com"
-"stevelasker","Steve Lasker","steve.lasker@microsoft.com"
+# It is structured to be consumable by both humans and programs.
+# To extract its contents programmatically, use any TOML-compliant parser.
 #
-# REVIEWERS
-# GitHub ID, Name, Email address
-"dmcgowan","Derek McGowan","derek@mcgstyle.net"
-"stevvooe","Stephen Day","stevvooe@gmail.com"
-"thajeztah","Sebastiaan van Stijn","github@gone.nl"
-"DavidSpek", "David van der Spek", "vanderspek.david@gmail.com"
-"Jamstah", "James Hewitt", "james.hewitt@gmail.com"
+# This file is compiled into the MAINTAINERS file in docker/opensource.
+#
+[Org]
+	[Org."Core maintainers"]
+		people = [
+			"aaronlehmann",
+			"dmcgowan",
+			"dmp42",
+			"richardscothern",
+			"shykes",
+			"stevvooe",
+		]
+
+[people]
+
+# A reference list of all people associated with the project.
+# All other sections should refer to people by their canonical key
+# in the people section.
+
+	# ADD YOURSELF HERE IN ALPHABETICAL ORDER
+
+	[people.aaronlehmann]
+	Name = "Aaron Lehmann"
+	Email = "aaron.lehmann@docker.com"
+	GitHub = "aaronlehmann"
+
+	[people.brianbland]
+	Name = "Brian Bland"
+	Email = "brian.bland@docker.com"
+	GitHub = "BrianBland"
+
+	[people.dmcgowan]
+	Name = "Derek McGowan"
+	Email = "derek@mcgstyle.net"
+	GitHub = "dmcgowan"
+
+	[people.dmp42]
+	Name = "Olivier Gambier"
+	Email = "olivier@docker.com"
+	GitHub = "dmp42"
+
+	[people.richardscothern]
+	Name = "Richard Scothern"
+	Email = "richard.scothern@gmail.com"
+	GitHub = "richardscothern"
+
+	[people.shykes]
+	Name = "Solomon Hykes"
+	Email = "solomon@docker.com"
+	GitHub = "shykes"
+
+	[people.stevvooe]
+	Name = "Stephen Day"
+	Email = "stephen.day@docker.com"
+	GitHub = "stevvooe"

Makefile

@@ -1,28 +1,9 @@
-.DEFAULT_GOAL := help
+# Set an output prefix, which is the local directory if not specified
+PREFIX?=$(shell pwd)
 
-# Root directory of the project (absolute path).
-ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 
 # Used to populate version variable in main package.
-VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
-REVISION ?= $(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
-
-# default compose command
-COMPOSE ?= docker compose
-
-PKG=github.com/distribution/distribution/v3
-
-# Project packages.
-PACKAGES=$(shell go list -tags "${BUILDTAGS}" ./... | grep -v /vendor/)
-INTEGRATION_PACKAGE=${PKG}
-COVERAGE_PACKAGES=$(filter-out ${PKG}/registry/storage/driver/%,${PACKAGES})
-
-IMAGE_REPO ?= distribution/distribution
-IMAGE_TAG ?= latest
-IMAGE_NAME ?= $(IMAGE_REPO):$(IMAGE_TAG)
-
-# Project binaries.
-COMMANDS=registry digest registry-api-descriptor-template
+VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
 
 # Allow turning off function inlining and variable registerization
 ifeq (${DISABLE_OPTIMIZATION},true)
@@ -30,157 +11,99 @@ ifeq (${DISABLE_OPTIMIZATION},true)
 	VERSION:="$(VERSION)-noopt"
 endif
 
-WHALE = "+"
+GO_LDFLAGS=-ldflags "-X `go list ./version`.Version=$(VERSION)"
 
-# Go files
-#
-TESTFLAGS_RACE=
-GOFILES=$(shell find . -type f -name '*.go')
-GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",)
-GO_LDFLAGS=-ldflags '-extldflags "-Wl,-z,now" -s -w -X $(PKG)/version.version=$(VERSION) -X $(PKG)/version.revision=$(REVISION) -X $(PKG)/version.mainpkg=$(PKG) $(EXTRA_LDFLAGS)'
-
-BINARIES=$(addprefix bin/,$(COMMANDS))
-
-# Flags passed to `go test`
-TESTFLAGS ?= -v $(TESTFLAGS_RACE)
-TESTFLAGS_PARALLEL ?= 8
-
-.PHONY: all build binaries clean test test-race test-full integration test-coverage validate lint validate-git validate-vendor vendor mod-outdated image validate-authors authors
+.PHONY: clean all fmt vet lint build test binaries
 .DEFAULT: all
+all: fmt vet lint build test binaries
 
-.PHONY: FORCE
-FORCE:
-
-##@ Build
+AUTHORS: .mailmap .git/HEAD
+	 git log --format='%aN <%aE>' | sort -fu > $@
 
 # This only needs to be generated by hand when cutting full releases.
 version/version.go:
-	@echo "$(WHALE) $@"
 	./version/version.sh > $@
 
-bin/%: cmd/% FORCE ## build individual binary
-	@echo "$(WHALE) $@${BINARY_SUFFIX}"
-	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS}  ./$<
+# Required for go 1.5 to build
+GO15VENDOREXPERIMENT := 1
 
-binaries: $(BINARIES) ## build binaries
-	@echo "$(WHALE) $@"
+# Package list
+PKGS := $(shell go list -tags "${DOCKER_BUILDTAGS}" ./... | grep -v ^github.com/docker/distribution/vendor/)
 
-build: ## build go packages
-	@echo "$(WHALE) $@"
-	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS} $(PACKAGES)
+# Resolving binary dependencies for specific targets
+GOLINT_BIN := $(GOPATH)/bin/golint
+GOLINT := $(shell [ -x $(GOLINT_BIN) ] && echo $(GOLINT_BIN) || echo '')
 
-image: ## build docker image IMAGE_NAME=<name>
-	docker buildx bake --set "*.tags=${IMAGE_NAME}" image-local
+GODEP_BIN := $(GOPATH)/bin/godep
+GODEP := $(shell [ -x $(GODEP_BIN) ] && echo $(GODEP_BIN) || echo '')
 
-clean: ## clean up binaries
-	@echo "$(WHALE) $@"
-	@rm -f $(BINARIES)
+${PREFIX}/bin/registry: $(wildcard **/*.go)
+	@echo "+ $@"
+	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/registry
 
-vendor: ## update vendor
-	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
-	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
-	rm -rf ./vendor
-	cp -R "$($@_TMP_OUT)"/out/* .
-	rm -rf $($@_TMP_OUT)/*
+${PREFIX}/bin/digest:  $(wildcard **/*.go)
+	@echo "+ $@"
+	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/digest
 
-mod-outdated: ## check outdated dependencies
-	docker buildx bake $@
+${PREFIX}/bin/registry-api-descriptor-template: $(wildcard **/*.go)
+	@echo "+ $@"
+	@go build -o $@ ${GO_LDFLAGS} ${GO_GCFLAGS} ./cmd/registry-api-descriptor-template
 
-authors: ## generate authors
-	docker buildx bake $@
+docs/spec/api.md: docs/spec/api.md.tmpl ${PREFIX}/bin/registry-api-descriptor-template
+	./bin/registry-api-descriptor-template $< > $@
 
-##@ Test
+vet:
+	@echo "+ $@"
+	@go vet -tags "${DOCKER_BUILDTAGS}" $(PKGS)
 
-test: ## run tests, except integration test with test.short
-	@echo "$(WHALE) $@"
-	@go test ${GO_TAGS} -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
+fmt:
+	@echo "+ $@"
+	@test -z "$$(gofmt -s -l . 2>&1 | grep -v ^vendor/ | tee /dev/stderr)" || \
+		(echo >&2 "+ please format Go code with 'gofmt -s'" && false)
 
-test-race: ## run tests, except integration test with test.short and race
-	@echo "$(WHALE) $@"
-	@go test ${GO_TAGS} -race -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
+lint:
+	@echo "+ $@"
+	$(if $(GOLINT), , \
+		$(error Please install golint: `go get -u github.com/golang/lint/golint`))
+	@test -z "$$($(GOLINT) ./... 2>&1 | grep -v ^vendor/ | tee /dev/stderr)"
 
-test-full: ## run tests, except integration tests
-	@echo "$(WHALE) $@"
-	@go test ${GO_TAGS} ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
+build:
+	@echo "+ $@"
+	@go build -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} $(PKGS)
 
-integration: ## run integration tests
-	@echo "$(WHALE) $@"
-	@go test ${TESTFLAGS} -parallel ${TESTFLAGS_PARALLEL} ${INTEGRATION_PACKAGE}
+test:
+	@echo "+ $@"
+	@go test -test.short -tags "${DOCKER_BUILDTAGS}" $(PKGS)
 
-test-coverage: ## run unit tests and generate test coverprofiles
-	@echo "$(WHALE) $@"
-	@rm -f coverage.txt
-	@go test ${GO_TAGS} -i ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${COVERAGE_PACKAGES}) 2> /dev/null
-	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${COVERAGE_PACKAGES}); do \
-		go test ${GO_TAGS} ${TESTFLAGS} \
-			-cover \
-			-coverprofile=profile.out \
-			-covermode=atomic $$pkg || exit; \
-		if [ -f profile.out ]; then \
-			cat profile.out >> coverage.txt; \
-			rm profile.out; \
-		fi; \
-	done )
+test-full:
+	@echo "+ $@"
+	@go test -tags "${DOCKER_BUILDTAGS}" $(PKGS)
 
-.PHONY: test-cloud-storage
-test-cloud-storage: start-cloud-storage run-s3-tests stop-cloud-storage ## run cloud storage driver tests
+binaries: ${PREFIX}/bin/registry ${PREFIX}/bin/digest ${PREFIX}/bin/registry-api-descriptor-template
+	@echo "+ $@"
 
-.PHONY: start-cloud-storage
-start-cloud-storage: ## start local cloud storage (minio)
-	$(COMPOSE) -f tests/docker-compose-storage.yml up minio minio-init -d
+clean:
+	@echo "+ $@"
+	@rm -rf "${PREFIX}/bin/registry" "${PREFIX}/bin/digest" "${PREFIX}/bin/registry-api-descriptor-template"
 
-.PHONY: stop-cloud-storage
-stop-cloud-storage: ## stop local cloud storage (minio)
-	$(COMPOSE) -f tests/docker-compose-storage.yml down
+dep-save:
+	@echo "+ $@"
+	$(if $(GODEP), , \
+		$(error Please install godep: go get github.com/tools/godep))
+	@$(GODEP) save $(PKGS)
 
-.PHONY: reset-cloud-storage
-reset-cloud-storage: ## reset (stop, delete, start) local cloud storage (minio)
-	$(COMPOSE) -f tests/docker-compose-storage.yml down
-	@mkdir -p tests/miniodata/distribution
-	@rm -rf tests/miniodata/distribution/* tests/miniodata/.minio.sys
-	$(COMPOSE) -f tests/docker-compose-storage.yml up minio minio-init -d
+dep-restore:
+	@echo "+ $@"
+	$(if $(GODEP), , \
+		$(error Please install godep: go get github.com/tools/godep))
+	@$(GODEP) restore -v
 
-.PHONY: run-s3-tests
-run-s3-tests: start-cloud-storage ## run S3 storage driver integration tests
-	AWS_ACCESS_KEY=distribution \
-	AWS_SECRET_KEY=password \
-	AWS_REGION=us-east-1 \
-	S3_BUCKET=images-local \
-	S3_ENCRYPT=false \
-	REGION_ENDPOINT=http://127.0.0.1:9000 \
-	S3_SECURE=false \
-	S3_ACCELERATE=false \
-	AWS_S3_FORCE_PATH_STYLE=true \
-	go test ${TESTFLAGS} -count=1 ./registry/storage/driver/s3-aws/...
-
-.PHONY: start-e2e-s3-env
-start-e2e-s3-env: ## starts E2E S3 storage test environment (S3, Redis, registry)
-	$(COMPOSE) -f tests/docker-compose-e2e-cloud-storage.yml up -d
-
-.PHONY: stop-e2e-s3-env
-stop-e2e-s3-env: ## stops E2E S3 storage test environment (S3, Redis, registry)
-	$(COMPOSE) -f tests/docker-compose-e2e-cloud-storage.yml down
-
-##@ Validate
-
-lint: ## run all linters
-	docker buildx bake $@
-
-validate: ## run all validators
-	docker buildx bake $@
-
-validate-git: ## validate git
-	docker buildx bake $@
-
-validate-vendor: ## validate vendor
-	docker buildx bake $@
-
-validate-authors: ## validate authors
-	docker buildx bake $@
-
-.PHONY: help
-help:
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m\033[0m\n"} /^[a-zA-Z0-9_\/%-]+:.*?##/ { printf "  \033[36m%-27s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
-	@echo ""
-	@echo "Go binaries:   $(BINARIES)"
-	@echo "Docker image: $(IMAGE_NAME)"
+dep-validate: dep-restore
+	@echo "+ $@"
+	@rm -Rf .vendor.bak
+	@mv vendor .vendor.bak
+	@rm -Rf Godeps
+	@$(GODEP) save ./...
+	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
+		(echo >&2 "+ borked dependencies! what you have in Godeps/Godeps.json does not match with what you have in vendor" && false)
+	@rm -Rf .vendor.bak

README.md

@@ -1,41 +1,32 @@
-<p align="center">
-<img style="align: center; padding-left: 10px; padding-right: 10px; padding-bottom: 10px;" width="238px" height="238px" src="./distribution-logo.svg" />
-</p>
+# Distribution
 
-[![Build Status](https://github.com/distribution/distribution/workflows/build/badge.svg?branch=main&event=push)](https://github.com/distribution/distribution/actions/workflows/build.yml?query=workflow%3Abuild)
-[![GoDoc](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white&style=flat-square)](https://pkg.go.dev/github.com/distribution/distribution)
-[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
-[![codecov](https://codecov.io/gh/distribution/distribution/branch/main/graph/badge.svg)](https://codecov.io/gh/distribution/distribution)
-[![FOSSA Status](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Fdistribution%2Fdistribution.svg?type=shield)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fdistribution%2Fdistribution?ref=badge_shield)
-[![OCI Conformance](https://github.com/distribution/distribution/workflows/conformance/badge.svg)](https://github.com/distribution/distribution/actions?query=workflow%3Aconformance)
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/distribution/distribution/badge)](https://securityscorecards.dev/viewer/?uri=github.com/distribution/distribution)
+The Docker toolset to pack, ship, store, and deliver content.
 
-The toolset to pack, ship, store, and deliver content.
+This repository's main product is the Docker Registry 2.0 implementation
+for storing and distributing Docker images. It supersedes the
+[docker/docker-registry](https://github.com/docker/docker-registry)
+project with a new API design, focused around security and performance.
 
-This repository's main product is the Open Source Registry implementation
-for storing and distributing container images and other content using the
-[OCI Distribution Specification](https://github.com/opencontainers/distribution-spec).
-The goal of this project is to provide a simple, secure, and scalable base
-for building a large scale registry solution or running a simple private registry.
-It is a core library for many registry operators including Docker Hub, GitHub Container Registry,
-GitLab Container Registry and DigitalOcean Container Registry, as well as the CNCF Harbor
-Project, and VMware Harbor Registry.
+<img src="https://www.docker.com/sites/default/files/oyster-registry-3.png" width=200px/>
+
+[![Circle CI](https://circleci.com/gh/docker/distribution/tree/master.svg?style=svg)](https://circleci.com/gh/docker/distribution/tree/master)
+[![GoDoc](https://godoc.org/github.com/docker/distribution?status.svg)](https://godoc.org/github.com/docker/distribution)
 
 This repository contains the following components:
 
 |**Component**       |Description                                                                                                                                                                                         |
 |--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| **registry**       | An implementation of the [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec).                                                                                                 |
-| **libraries**      | A rich set of libraries for interacting with distribution components. Please see [godoc](https://pkg.go.dev/github.com/distribution/distribution) for details. **Note**: The interfaces for these libraries are **unstable**. |
-| **documentation**  | Full documentation is available at [https://distribution.github.io/distribution](https://distribution.github.io/distribution/).
+| **registry**       | An implementation of the [Docker Registry HTTP API V2](docs/spec/api.md) for use with docker 1.6+.                                                                                                  |
+| **libraries**      | A rich set of libraries for interacting with distribution components. Please see [godoc](https://godoc.org/github.com/docker/distribution) for details. **Note**: These libraries are **unstable**. |
+| **specifications** | _Distribution_ related specifications are available in [docs/spec](docs/spec)                                                                                                                        |
+| **documentation**  | Docker's full documentation set is available at [docs.docker.com](https://docs.docker.com). This repository [contains the subset](docs/index.md) related just to the registry.                                                                                                                                          |
 
-### How does this integrate with Docker, containerd, and other OCI client?
+### How does this integrate with Docker engine?
 
-Clients implement against the OCI specification and communicate with the
-registry using HTTP. This project contains a client implementation which
-is currently in use by Docker, however, it is deprecated for the
-[implementation in containerd](https://github.com/containerd/containerd/tree/master/remotes/docker)
-and will not support new features.
+This project should provide an implementation to a V2 API for use in the [Docker
+core project](https://github.com/docker/docker). The API should be embeddable
+and simplify the process of securely pulling and pushing content from `docker`
+daemons.
 
 ### What are the long term goals of the Distribution project?
 
@@ -52,23 +43,89 @@ system that allow users to:
 * Implement their own home made solution through good specs, and solid
   extensions mechanism.
 
-## Contribution
+## More about Registry 2.0
+
+The new registry implementation provides the following benefits:
+
+- faster push and pull
+- new, more efficient implementation
+- simplified deployment
+- pluggable storage backend
+- webhook notifications
+
+For information on upcoming functionality, please see [ROADMAP.md](ROADMAP.md).
+
+### Who needs to deploy a registry?
+
+By default, Docker users pull images from Docker's public registry instance.
+[Installing Docker](https://docs.docker.com/engine/installation/) gives users this
+ability. Users can also push images to a repository on Docker's public registry,
+if they have a [Docker Hub](https://hub.docker.com/) account. 
+
+For some users and even companies, this default behavior is sufficient. For
+others, it is not. 
+
+For example, users with their own software products may want to maintain a
+registry for private, company images. Also, you may wish to deploy your own
+image repository for images used to test or in continuous integration. For these
+use cases and others, [deploying your own registry instance](docs/deploying.md)
+may be the better choice.
+
+### Migration to Registry 2.0
+
+For those who have previously deployed their own registry based on the Registry
+1.0 implementation and wish to deploy a Registry 2.0 while retaining images,
+data migration is required. A tool to assist with migration efforts has been
+created. For more information see [docker/migrator]
+(https://github.com/docker/migrator).
+
+## Contribute
 
 Please see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute
 issues, fixes, and patches to this project. If you are contributing code, see
-the instructions for [building a development environment](BUILDING.md).
+the instructions for [building a development environment](docs/building.md).
 
-## Communication
+## Support
 
-For async communication and long running discussions please use issues and pull requests on the github repo.
-This will be the best place to discuss design and implementation.
+If any issues are encountered while using the _Distribution_ project, several
+avenues are available for support:
 
-For sync communication we have a #distribution channel in the [CNCF Slack](https://slack.cncf.io/)
-that everyone is welcome to join and chat about development.
+<table>
+<tr>
+	<th align="left">
+	IRC
+	</th>
+	<td>
+	#docker-distribution on FreeNode
+	</td>
+</tr>
+<tr>
+	<th align="left">
+	Issue Tracker
+	</th>
+	<td>
+	github.com/docker/distribution/issues
+	</td>
+</tr>
+<tr>
+	<th align="left">
+	Google Groups
+	</th>
+	<td>
+	https://groups.google.com/a/dockerproject.org/forum/#!forum/distribution
+	</td>
+</tr>
+<tr>
+	<th align="left">
+	Mailing List
+	</th>
+	<td>
+	docker@dockerproject.org
+	</td>
+</tr>
+</table>
 
-## Licenses
 
-The distribution codebase is released under the [Apache 2.0 license](LICENSE).
-The README.md file, and files in the "docs" folder are licensed under the
-Creative Commons Attribution 4.0 International License. You may obtain a
-copy of the license, titled CC-BY-4.0, at http://creativecommons.org/licenses/by/4.0/.
+## License
+
+This project is distributed under [Apache License, Version 2.0](LICENSE).

ROADMAP.md

@@ -1,16 +1,267 @@
 # Roadmap
 
-The Distribution project aims to support the following use cases
+The Distribution Project consists of several components, some of which are
+still being defined. This document defines the high-level goals of the
+project, identifies the current components, and defines the release-
+relationship to the Docker Platform.
 
-1. A library to support building highly scalable and reliable container registries,
-that can be customised for different backends and use cases. This is used by many
-of the largest registry operators, including Docker Hub, GitHub, GitLab, Harbor
-and Digital Ocean.
-2. A reference implementation of the OCI registry standards, and an easy way to
-experiment with new propsals in the registry space as these standards change.
-3. Distributed registry tools, such as caching registries and local registries
-that can be used within clusters for performance and locality use cases.
+* [Distribution Goals](#distribution-goals)
+* [Distribution Components](#distribution-components)
+* [Project Planning](#project-planning): release-relationship to the Docker Platform.
+
+This road map is a living document, providing an overview of the goals and
+considerations made in respect of the future of the project.
+
+## Distribution Goals
+
+- Replace the existing [docker registry](github.com/docker/docker-registry)
+  implementation as the primary implementation.
+- Replace the existing push and pull code in the docker engine with the
+  distribution package.
+- Define a strong data model for distributing docker images
+- Provide a flexible distribution tool kit for use in the docker platform
+- Unlock new distribution models
+
+## Distribution Components
+
+Components of the Distribution Project are managed via github [milestones](https://github.com/docker/distribution/milestones). Upcoming
+features and bugfixes for a component will be added to the relevant milestone. If a feature or
+bugfix is not part of a milestone, it is currently unscheduled for
+implementation. 
+
+* [Registry](#registry)
+* [Distribution Package](#distribution-package)
+
+***
+
+### Registry
+
+The new Docker registry is the main portion of the distribution repository.
+Registry 2.0 is the first release of the next-generation registry. This was
+primarily focused on implementing the [new registry
+API](https://github.com/docker/distribution/blob/master/docs/spec/api.md),
+with a focus on security and performance. 
+
+Following from the Distribution project goals above, we have a set of goals
+for registry v2 that we would like to follow in the design. New features
+should be compared against these goals.
+
+#### Data Storage and Distribution First
+
+The registry's first goal is to provide a reliable, consistent storage
+location for Docker images. The registry should only provide the minimal
+amount of indexing required to fetch image data and no more.
+
+This means we should be selective in new features and API additions, including
+those that may require expensive, ever growing indexes. Requests should be
+servable in "constant time".
+
+#### Content Addressability
+
+All data objects used in the registry API should be content addressable.
+Content identifiers should be secure and verifiable. This provides a secure,
+reliable base from which to build more advanced content distribution systems.
+
+#### Content Agnostic
+
+In the past, changes to the image format would require large changes in Docker
+and the Registry. By decoupling the distribution and image format, we can
+allow the formats to progress without having to coordinate between the two.
+This means that we should be focused on decoupling Docker from the registry
+just as much as decoupling the registry from Docker. Such an approach will
+allow us to unlock new distribution models that haven't been possible before.
+
+We can take this further by saying that the new registry should be content
+agnostic. The registry provides a model of names, tags, manifests and content
+addresses and that model can be used to work with content.
+
+#### Simplicity
+
+The new registry should be closer to a microservice component than its
+predecessor. This means it should have a narrower API and a low number of
+service dependencies. It should be easy to deploy.
+
+This means that other solutions should be explored before changing the API or
+adding extra dependencies. If functionality is required, can it be added as an
+extension or companion service.
+
+#### Extensibility
+
+The registry should provide extension points to add functionality. By keeping
+the scope narrow, but providing the ability to add functionality.
+
+Features like search, indexing, synchronization and registry explorers fall
+into this category. No such feature should be added unless we've found it
+impossible to do through an extension.
+
+#### Active Feature Discussions
+
+The following are feature discussions that are currently active.
+
+If you don't see your favorite, unimplemented feature, feel free to contact us
+via IRC or the mailing list and we can talk about adding it. The goal here is
+to make sure that new features go through a rigid design process before
+landing in the registry.
+
+##### Proxying to other Registries
+
+A _pull-through caching_ mode exists for the registry, but is restricted from 
+within the docker client to only mirror the official Docker Hub.  This functionality
+can be expanded when image provenance has been specified and implemented in the 
+distribution project.
+
+##### Metadata storage
+
+Metadata for the registry is currently stored with the manifest and layer data on
+the storage backend.  While this is a big win for simplicity and reliably maintaining
+state, it comes with the cost of consistency and high latency.  The mutable registry
+metadata operations should be abstracted behind an API which will allow ACID compliant
+storage systems to handle metadata.
+
+##### Peer to Peer transfer
+
+Discussion has started here: https://docs.google.com/document/d/1rYDpSpJiQWmCQy8Cuiaa3NH-Co33oK_SC9HeXYo87QA/edit
+
+##### Indexing, Search and Discovery
+
+The original registry provided some implementation of search for use with
+private registries. Support has been elided from V2 since we'd like to both
+decouple search functionality from the registry. The makes the registry
+simpler to deploy, especially in use cases where search is not needed, and
+let's us decouple the image format from the registry.
+
+There are explorations into using the catalog API and notification system to
+build external indexes. The current line of thought is that we will define a
+common search API to index and query docker images. Such a system could be run
+as a companion to a registry or set of registries to power discovery.
+
+The main issue with search and discovery is that there are so many ways to
+accomplish it. There are two aspects to this project. The first is deciding on
+how it will be done, including an API definition that can work with changing
+data formats. The second is the process of integrating with `docker search`.
+We expect that someone attempts to address the problem with the existing tools
+and propose it as a standard search API or uses it to inform a standardization
+process. Once this has been explored, we integrate with the docker client.
+
+Please see the following for more detail:
+
+- https://github.com/docker/distribution/issues/206
+
+##### Deletes
+
+> __NOTE:__ Deletes are a much asked for feature. Before requesting this
+feature or participating in discussion, we ask that you read this section in
+full and understand the problems behind deletes.
+
+While, at first glance, implementing deleting seems simple, there are a number
+mitigating factors that make many solutions not ideal or even pathological in
+the context of a registry. The following paragraph discuss the background and
+approaches that could be applied to a arrive at a solution.
+
+The goal of deletes in any system is to remove unused or unneeded data. Only
+data requested for deletion should be removed and no other data. Removing
+unintended data is worse than _not_ removing data that was requested for
+removal but ideally, both are supported. Generally, according to this rule, we
+err on holding data longer than needed, ensuring that it is only removed when
+we can be certain that it can be removed. With the current behavior, we opt to
+hold onto the data forever, ensuring that data cannot be incorrectly removed.
+
+To understand the problems with implementing deletes, one must understand the
+data model. All registry data is stored in a filesystem layout, implemented on
+a "storage driver", effectively a _virtual file system_ (VFS). The storage
+system must assume that this VFS layer will be eventually consistent and has
+poor read- after-write consistency, since this is the lower common denominator
+among the storage drivers. This is mitigated by writing values in reverse-
+dependent order, but makes wider transactional operations unsafe.
+
+Layered on the VFS model is a content-addressable _directed, acyclic graph_
+(DAG) made up of blobs. Manifests reference layers. Tags reference manifests.
+Since the same data can be referenced by multiple manifests, we only store
+data once, even if it is in different repositories. Thus, we have a set of
+blobs, referenced by tags and manifests. If we want to delete a blob we need
+to be certain that it is no longer referenced by another manifest or tag. When
+we delete a manifest, we also can try to delete the referenced blobs. Deciding
+whether or not a blob has an active reference is the crux of the problem.
+
+Conceptually, deleting a manifest and its resources is quite simple. Just find
+all the manifests, enumerate the referenced blobs and delete the blobs not in
+that set. An astute observer will recognize this as a garbage collection
+problem. As with garbage collection in programming languages, this is very
+simple when one always has a consistent view. When one adds parallelism and an
+inconsistent view of data, it becomes very challenging.
+
+A simple example can demonstrate this. Let's say we are deleting a manifest
+_A_ in one process. We scan the manifest and decide that all the blobs are
+ready for deletion. Concurrently, we have another process accepting a new
+manifest _B_ referencing one or more blobs from the manifest _A_. Manifest _B_
+is accepted and all the blobs are considered present, so the operation
+proceeds. The original process then deletes the referenced blobs, assuming
+they were unreferenced. The manifest _B_, which we thought had all of its data
+present, can no longer be served by the registry, since the dependent data has
+been deleted.
+
+Deleting data from the registry safely requires some way to coordinate this
+operation. The following approaches are being considered:
+
+- _Reference Counting_ - Maintain a count of references to each blob. This is
+  challenging for a number of reasons: 1. maintaining a consistent consensus
+  of reference counts across a set of Registries and 2. Building the initial
+  list of reference counts for an existing registry. These challenges can be
+  met with a consensus protocol like Paxos or Raft in the first case and a
+  necessary but simple scan in the second..
+- _Lock the World GC_ - Halt all writes to the data store. Walk the data store
+  and find all blob references. Delete all unreferenced blobs. This approach
+  is very simple but requires disabling writes for a period of time while the
+  service reads all data. This is slow and expensive but very accurate and
+  effective.
+- _Generational GC_ - Do something similar to above but instead of blocking
+  writes, writes are sent to another storage backend while reads are broadcast
+  to the new and old backends. GC is then performed on the read-only portion.
+  Because writes land in the new backend, the data in the read-only section
+  can be safely deleted. The main drawbacks of this approach are complexity
+  and coordination.
+- _Centralized Oracle_ - Using a centralized, transactional database, we can
+  know exactly which data is referenced at any given time. This avoids
+  coordination problem by managing this data in a single location. We trade
+  off metadata scalability for simplicity and performance. This is a very good
+  option for most registry deployments. This would create a bottleneck for
+  registry metadata. However, metadata is generally not the main bottleneck
+  when serving images.
+
+Please let us know if other solutions exist that we have yet to enumerate.
+Note that for any approach, implementation is a massive consideration. For
+example, a mark-sweep based solution may seem simple but the amount of work in
+coordination offset the extra work it might take to build a _Centralized
+Oracle_. We'll accept proposals for any solution but please coordinate with us
+before dropping code.
+
+At this time, we have traded off simplicity and ease of deployment for disk
+space. Simplicity and ease of deployment tend to reduce developer involvement,
+which is currently the most expensive resource in software engineering. Taking
+on any solution for deletes will greatly effect these factors, trading off
+very cheap disk space for a complex deployment and operational story.
+
+Please see the following issues for more detail:
+
+- https://github.com/docker/distribution/issues/422
+- https://github.com/docker/distribution/issues/461
+- https://github.com/docker/distribution/issues/462
+
+### Distribution Package 
+
+At its core, the Distribution Project is a set of Go packages that make up
+Distribution Components. At this time, most of these packages make up the
+Registry implementation. 
+
+The package itself is considered unstable. If you're using it, please take care to vendor the dependent version. 
+
+For feature additions, please see the Registry section. In the future, we may break out a
+separate Roadmap for distribution-specific features that apply to more than
+just the registry.
+
+***
+
+### Project Planning
+
+An [Open-Source Planning Process](https://github.com/docker/distribution/wiki/Open-Source-Planning-Process) is used to define the Roadmap. [Project Pages](https://github.com/docker/distribution/wiki) define the goals for each Milestone and identify current progress.
 
-As every container application needs at least one registry as part of its infrastructure,
-and more cloud native artifacts are using registries as the basis of their distribution,
-having a widely used and supported open source registry is important for innovation.

SECURITY.md

@@ -1,17 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-These versions are currently receiving security updates.
-
-| Version      | Supported          | Notes |
-| ------------ | ------------------ | ----- |
-| 3.0.x (main) | :white_check_mark: | This is the next major version and has not yet been released. |
-| 2.8.x        | :white_check_mark: | This is the latest released version. |
-| < 2.8        | :x:                | |
-
-## Reporting a Vulnerability
-
-The maintainers take security seriously. If you discover a security issue, please bring it to their attention right away!
-
-Please DO NOT file a public issue, instead send your report privately to cncf-distribution-security@lists.cncf.io.

blobs.go

@@ -1,16 +1,15 @@
 package distribution
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"time"
 
-	"github.com/distribution/reference"
-	"github.com/opencontainers/go-digest"
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/docker/distribution/context"
+	"github.com/docker/distribution/digest"
+	"github.com/docker/distribution/reference"
 )
 
 var (
@@ -63,22 +62,12 @@ type Descriptor struct {
 	// encoded as utf-8.
 	MediaType string `json:"mediaType,omitempty"`
 
-	// Digest uniquely identifies the content. A byte stream can be verified
-	// against this digest.
-	Digest digest.Digest `json:"digest,omitempty"`
-
 	// Size in bytes of content.
 	Size int64 `json:"size,omitempty"`
 
-	// URLs contains the source URLs of this content.
-	URLs []string `json:"urls,omitempty"`
-
-	// Annotations contains arbitrary metadata relating to the targeted content.
-	Annotations map[string]string `json:"annotations,omitempty"`
-
-	// Platform describes the platform which the image in the manifest runs on.
-	// This should only be used when referring to a manifest.
-	Platform *v1.Platform `json:"platform,omitempty"`
+	// Digest uniquely identifies the content. A byte stream can be verified
+	// against against this digest.
+	Digest digest.Digest `json:"digest,omitempty"`
 
 	// NOTE: Before adding a field here, please ensure that all
 	// other options have been exhausted. Much of the type relationships
@@ -135,9 +124,11 @@ type BlobDescriptorService interface {
 	Clear(ctx context.Context, dgst digest.Digest) error
 }
 
-// BlobDescriptorServiceFactory creates middleware for BlobDescriptorService.
-type BlobDescriptorServiceFactory interface {
-	BlobAccessController(svc BlobDescriptorService) BlobDescriptorService
+// ReadSeekCloser is the primary reader type for blob data, combining
+// io.ReadSeeker with io.Closer.
+type ReadSeekCloser interface {
+	io.ReadSeeker
+	io.Closer
 }
 
 // BlobProvider describes operations for getting blob data.
@@ -145,14 +136,15 @@ type BlobProvider interface {
 	// Get returns the entire blob identified by digest along with the descriptor.
 	Get(ctx context.Context, dgst digest.Digest) ([]byte, error)
 
-	// Open provides an [io.ReadSeekCloser] to the blob identified by the provided
-	// descriptor. If the blob is not known to the service, an error is returned.
-	Open(ctx context.Context, dgst digest.Digest) (io.ReadSeekCloser, error)
+	// Open provides a ReadSeekCloser to the blob identified by the provided
+	// descriptor. If the blob is not known to the service, an error will be
+	// returned.
+	Open(ctx context.Context, dgst digest.Digest) (ReadSeekCloser, error)
 }
 
 // BlobServer can serve blobs via http.
 type BlobServer interface {
-	// ServeBlob attempts to serve the blob, identified by dgst, via http. The
+	// ServeBlob attempts to serve the blob, identifed by dgst, via http. The
 	// service may decide to redirect the client elsewhere or serve the data
 	// directly.
 	//
@@ -192,18 +184,6 @@ type BlobCreateOption interface {
 	Apply(interface{}) error
 }
 
-// CreateOptions is a collection of blob creation modifiers relevant to general
-// blob storage intended to be configured by the BlobCreateOption.Apply method.
-type CreateOptions struct {
-	Mount struct {
-		ShouldMount bool
-		From        reference.Canonical
-		// Stat allows to pass precalculated descriptor to link and return.
-		// Blob access check will be skipped if set.
-		Stat *Descriptor
-	}
-}
-
 // BlobWriter provides a handle for inserting data into a blob store.
 // Instances should be obtained from BlobWriteService.Writer and
 // BlobWriteService.Resume. If supported by the store, a writer can be

circle.yml

@@ -0,0 +1,89 @@
+# Pony-up!
+machine:
+  pre:
+  # Install gvm
+    - bash < <(curl -s -S -L https://raw.githubusercontent.com/moovweb/gvm/1.0.22/binscripts/gvm-installer)
+  # Install codecov for coverage
+    - pip install --user codecov
+
+  post:
+  # go
+    - gvm install go1.6 --prefer-binary --name=stable
+
+  environment:
+  # Convenient shortcuts to "common" locations
+    CHECKOUT: /home/ubuntu/$CIRCLE_PROJECT_REPONAME
+    BASE_DIR: src/github.com/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME
+  # Trick circle brainflat "no absolute path" behavior
+    BASE_STABLE: ../../../$HOME/.gvm/pkgsets/stable/global/$BASE_DIR
+    DOCKER_BUILDTAGS: "include_oss include_gcs"
+  # Workaround Circle parsing dumb bugs and/or YAML wonkyness
+    CIRCLE_PAIN: "mode: set"
+
+  hosts:
+  # Not used yet
+    fancy: 127.0.0.1
+
+dependencies:
+  pre:
+  # Copy the code to the gopath of all go versions
+    - >
+      gvm use stable &&
+      mkdir -p "$(dirname $BASE_STABLE)" &&
+      cp -R "$CHECKOUT" "$BASE_STABLE"
+
+  override:
+  # Install dependencies for every copied clone/go version
+    - gvm use stable && go get github.com/tools/godep:
+        pwd: $BASE_STABLE
+
+  post:
+  # For the stable go version, additionally install linting tools
+    - >
+      gvm use stable &&
+      go get github.com/axw/gocov/gocov github.com/golang/lint/golint
+
+test:
+  pre:
+  # Output the go versions we are going to test
+    # - gvm use old && go version
+    - gvm use stable && go version
+
+  # Ensure validation of dependencies
+    - gvm use stable && if test -n "`git diff --stat=1000 master | grep -Ei \"vendor|godeps\"`"; then make dep-validate; fi:
+        pwd: $BASE_STABLE
+
+  # First thing: build everything. This will catch compile errors, and it's
+  # also necessary for go vet to work properly (see #807).
+    - gvm use stable && godep go install $(go list ./... | grep -v "/vendor/"):
+        pwd: $BASE_STABLE
+
+  # FMT
+    - gvm use stable && make fmt:
+        pwd: $BASE_STABLE
+
+   # VET
+    - gvm use stable && make vet:
+        pwd: $BASE_STABLE
+
+  # LINT
+    - gvm use stable && make lint:
+        pwd: $BASE_STABLE
+
+  override:
+  # Test stable, and report
+     - gvm use stable; export ROOT_PACKAGE=$(go list .); go list -tags "$DOCKER_BUILDTAGS" ./... | grep -v "/vendor/" | xargs -L 1 -I{} bash -c 'export PACKAGE={}; godep go test -tags "$DOCKER_BUILDTAGS" -test.short -coverprofile=$GOPATH/src/$PACKAGE/coverage.out -coverpkg=$(./coverpkg.sh $PACKAGE $ROOT_PACKAGE) $PACKAGE':
+         timeout: 600
+         pwd: $BASE_STABLE
+
+  post:
+  # Report to codecov
+    - bash <(curl -s https://codecov.io/bash):
+        pwd: $BASE_STABLE
+
+  ## Notes
+  # Disabled the -race detector due to massive memory usage.
+  # Do we want these as well?
+  # - go get code.google.com/p/go.tools/cmd/goimports
+  # - test -z "$(goimports -l -w ./... | tee /dev/stderr)"
+  # http://labix.org/gocheck

cmd/digest/main.go

@@ -7,11 +7,8 @@ import (
 	"log"
 	"os"
 
-	"github.com/distribution/distribution/v3/version"
-	"github.com/opencontainers/go-digest"
-
-	_ "crypto/sha256"
-	_ "crypto/sha512"
+	"github.com/docker/distribution/digest"
+	"github.com/docker/distribution/version"
 )
 
 var (
@@ -35,7 +32,7 @@ func init() {
 
 func usage() {
 	fmt.Fprintf(os.Stderr, "usage: %s [files...]\n", os.Args[0])
-	fmt.Fprint(os.Stderr, `
+	fmt.Fprintf(os.Stderr, `
 Calculate the digest of one or more input files, emitting the result
 to standard out. If no files are provided, the digest of stdin will
 be calculated.
@@ -62,6 +59,7 @@ func main() {
 	if flag.NArg() > 0 {
 		for _, path := range flag.Args() {
 			fp, err := os.Open(path)
+
 			if err != nil {
 				log.Printf("%s: %v", path, err)
 				fail = true

cmd/registry-api-descriptor-template/main.go

@@ -4,7 +4,7 @@
 // For example, to generate a new API specification, one would execute the
 // following command from the repo root:
 //
-//	$ registry-api-descriptor-template docs/spec/api.md.tmpl > docs/spec/api.md
+// 	$ registry-api-descriptor-template docs/spec/api.md.tmpl > docs/spec/api.md
 //
 // The templates are passed in the api/v2.APIDescriptor object. Please see the
 // package documentation for fields available on that object. The template
@@ -20,13 +20,14 @@ import (
 	"regexp"
 	"text/template"
 
-	"github.com/distribution/distribution/v3/registry/api/errcode"
-	v2 "github.com/distribution/distribution/v3/registry/api/v2"
+	"github.com/docker/distribution/registry/api/errcode"
+	"github.com/docker/distribution/registry/api/v2"
 )
 
 var spaceRegex = regexp.MustCompile(`\n\s*`)
 
 func main() {
+
 	if len(os.Args) != 2 {
 		log.Fatalln("please specify a template to execute.")
 	}
@@ -126,4 +127,5 @@ end:
 	}
 
 	return output
+
 }

cmd/registry/config-cache.yml

@@ -12,8 +12,6 @@ storage:
     maintenance:
         uploadpurging:
             enabled: false
-    tag:
-      concurrencylimit: 8
 http:
     addr: :5000
     secret: asecretforlocaldevelopment
@@ -22,16 +20,15 @@ http:
     headers:
         X-Content-Type-Options: [nosniff]
 redis:
-  addrs: [localhost:6379]
-  maxidleconns: 16
-  poolsize: 64
-  connmaxidletime: 300s
+  addr: localhost:6379
+  pool:
+    maxidle: 16
+    maxactive: 64
+    idletimeout: 300s
   dialtimeout: 10ms
   readtimeout: 10ms
   writetimeout: 10ms
 notifications:
-    events:
-        includereferences: true
     endpoints:
         - name: local-8082
           url: http://localhost:5003/callback

cmd/registry/config-dev-frostfs.yml

@@ -1,50 +0,0 @@
-version: 0.1
-log:
-  level: debug
-  fields:
-    service: registry
-    environment: development
-storage:
-  delete:
-    enabled: true
-  maintenance:
-    uploadpurging:
-      enabled: false
-  frostfs:
-    wallet:
-      path: /path/to/wallet.json
-      password: ""
-    peers:
-      0:
-        address: s01.frostfs.devenv:8080
-        weight: 1
-        priority: 1
-      1:
-        address: s02.frostfs.devenv:8080
-        weight: 1
-        priority: 1
-      2:
-        address: s03.frostfs.devenv:8080
-        weight: 1
-        priority: 1
-      3:
-        address: s04.frostfs.devenv:8080
-        weight: 1
-        priority: 1
-    # container can be nicename (rpc_endpoint is required)
-    container: ChzA3qeJHbAT2nyo35LofdJ7jMqVuT9h3WoRpxHRn9Uq
-    # the following params are optional
-    session_expiration_duration: 1000 # in blocks
-    connection_timeout: 5s
-    request_timeout: 5s
-    rebalance_interval: 30s
-    rpc_endpoint: http://morph-chain.frostfs.devenv:30333
-http:
-  addr: :5000
-  headers:
-    X-Content-Type-Options: [ nosniff ]
-health:
-  storagedriver:
-    enabled: true
-    interval: 30s
-    threshold: 3

cmd/registry/config-dev.yml

@@ -4,27 +4,61 @@ log:
   fields:
     service: registry
     environment: development
+  hooks:
+    - type: mail
+      disabled: true
+      levels:
+        - panic
+      options:
+        smtp:
+          addr: mail.example.com:25
+          username: mailuser
+          password: password
+          insecure: true
+        from: sender@example.com
+        to:
+          - errors@example.com
 storage:
     delete:
       enabled: true
     cache:
-        blobdescriptor: inmemory
+        blobdescriptor: redis
     filesystem:
         rootdirectory: /var/lib/registry
     maintenance:
         uploadpurging:
             enabled: false
-    tag:
-      concurrencylimit: 8
 http:
     addr: :5000
     debug:
-        addr: :5001
-        prometheus:
-            enabled: true
-            path: /metrics
+        addr: localhost:5001
     headers:
         X-Content-Type-Options: [nosniff]
+redis:
+  addr: localhost:6379
+  pool:
+    maxidle: 16
+    maxactive: 64
+    idletimeout: 300s
+  dialtimeout: 10ms
+  readtimeout: 10ms
+  writetimeout: 10ms
+notifications:
+    endpoints:
+        - name: local-5003
+          url: http://localhost:5003/callback
+          headers:
+             Authorization: [Bearer <an example token>]
+          timeout: 1s
+          threshold: 10
+          backoff: 1s
+          disabled: true
+        - name: local-8083
+          url: http://localhost:8083/callback
+          timeout: 1s
+          threshold: 10
+          backoff: 1s
+          disabled: true 
 health:
   storagedriver:
     enabled: true

cmd/registry/config-example.yml

@@ -7,16 +7,10 @@ storage:
     blobdescriptor: inmemory
   filesystem:
     rootdirectory: /var/lib/registry
-  tag:
-    concurrencylimit: 8
 http:
   addr: :5000
   headers:
     X-Content-Type-Options: [nosniff]
-auth:
-  htpasswd:
-    realm: basic-realm
-    path: /etc/registry
 health:
   storagedriver:
     enabled: true

cmd/registry/main.go

@@ -3,26 +3,22 @@ package main
 import (
 	_ "net/http/pprof"
 
-	"github.com/distribution/distribution/v3/registry"
-	_ "github.com/distribution/distribution/v3/registry/auth/htpasswd"
-	_ "github.com/distribution/distribution/v3/registry/auth/silly"
-	_ "github.com/distribution/distribution/v3/registry/auth/token"
-	_ "github.com/distribution/distribution/v3/registry/proxy"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/azure"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/filesystem"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/frostfs"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/gcs"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/inmemory"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/middleware/cloudfront"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/middleware/redirect"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/middleware/rewrite"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/s3-aws"
+	"github.com/docker/distribution/registry"
+	_ "github.com/docker/distribution/registry/auth/htpasswd"
+	_ "github.com/docker/distribution/registry/auth/silly"
+	_ "github.com/docker/distribution/registry/auth/token"
+	_ "github.com/docker/distribution/registry/proxy"
+	_ "github.com/docker/distribution/registry/storage/driver/azure"
+	_ "github.com/docker/distribution/registry/storage/driver/filesystem"
+	_ "github.com/docker/distribution/registry/storage/driver/gcs"
+	_ "github.com/docker/distribution/registry/storage/driver/inmemory"
+	_ "github.com/docker/distribution/registry/storage/driver/middleware/cloudfront"
+	_ "github.com/docker/distribution/registry/storage/driver/oss"
+	_ "github.com/docker/distribution/registry/storage/driver/s3-aws"
+	_ "github.com/docker/distribution/registry/storage/driver/s3-goamz"
+	_ "github.com/docker/distribution/registry/storage/driver/swift"
 )
 
 func main() {
-	// NOTE(milosgajdos): if the only two commands registered
-	// with registry.RootCmd fail they will halt the program
-	// execution and  exit the program with non-zero exit code.
-	// nolint:errcheck
 	registry.RootCmd.Execute()
 }

configuration/configuration.go

@@ -1,15 +1,13 @@
 package configuration
 
 import (
-	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
 	"reflect"
 	"strings"
 	"time"
-
-	"github.com/redis/go-redis/v9"
 )
 
 // Configuration is a versioned registry configuration, intended to be provided by a yaml file, and
@@ -24,14 +22,8 @@ type Configuration struct {
 	// Log supports setting various parameters related to the logging
 	// subsystem.
 	Log struct {
-		// AccessLog configures access logging.
-		AccessLog struct {
-			// Disabled disables access logging.
-			Disabled bool `yaml:"disabled,omitempty"`
-		} `yaml:"accesslog,omitempty"`
-
 		// Level is the granularity at which registry operations are logged.
-		Level Loglevel `yaml:"level,omitempty"`
+		Level Loglevel `yaml:"level"`
 
 		// Formatter overrides the default formatter with another. Options
 		// include "text", "json" and "logstash".
@@ -41,17 +33,13 @@ type Configuration struct {
 		// the logger context.
 		Fields map[string]interface{} `yaml:"fields,omitempty"`
 
-		// Hooks allows users to configure the log hooks, to enabling the
+		// Hooks allows users to configurate the log hooks, to enabling the
 		// sequent handling behavior, when defined levels of log message emit.
 		Hooks []LogHook `yaml:"hooks,omitempty"`
-
-		// ReportCaller allows user to configure the log to report the caller
-		ReportCaller bool `yaml:"reportcaller,omitempty"`
 	}
 
-	// Loglevel is the level at which registry operations are logged.
-	//
-	// Deprecated: Use Log.Level instead.
+	// Loglevel is the level at which registry operations are logged. This is
+	// deprecated. Please use Log.Level in the future.
 	Loglevel Loglevel `yaml:"loglevel,omitempty"`
 
 	// Storage is the configuration for the registry's storage driver
@@ -64,6 +52,9 @@ type Configuration struct {
 	// Middleware lists all middlewares to be used by the registry.
 	Middleware map[string][]Middleware `yaml:"middleware,omitempty"`
 
+	// Reporting is the configuration for error reporting
+	Reporting Reporting `yaml:"reporting,omitempty"`
+
 	// HTTP contains configuration parameters for the registry's http
 	// interface.
 	HTTP struct {
@@ -86,10 +77,6 @@ type Configuration struct {
 		// Location headers
 		RelativeURLs bool `yaml:"relativeurls,omitempty"`
 
-		// Amount of time to wait for connection to drain before shutting down when registry
-		// receives a stop signal
-		DrainTimeout time.Duration `yaml:"draintimeout,omitempty"`
-
 		// TLS instructs the http server to listen with a TLS configuration.
 		// This only support simple tls configuration with a cert and key.
 		// Mostly, this is useful for testing situations or simple deployments
@@ -108,33 +95,6 @@ type Configuration struct {
 			// Specifies the CA certs for client authentication
 			// A file may contain multiple CA certificates encoded as PEM
 			ClientCAs []string `yaml:"clientcas,omitempty"`
-
-			// Specifies the lowest TLS version allowed
-			MinimumTLS string `yaml:"minimumtls,omitempty"`
-
-			// Specifies a list of cipher suites allowed
-			CipherSuites []string `yaml:"ciphersuites,omitempty"`
-
-			// LetsEncrypt is used to configuration setting up TLS through
-			// Let's Encrypt instead of manually specifying certificate and
-			// key. If a TLS certificate is specified, the Let's Encrypt
-			// section will not be used.
-			LetsEncrypt struct {
-				// CacheFile specifies cache file to use for lets encrypt
-				// certificates and keys.
-				CacheFile string `yaml:"cachefile,omitempty"`
-
-				// Email is the email to use during Let's Encrypt registration
-				Email string `yaml:"email,omitempty"`
-
-				// Hosts specifies the hosts which are allowed to obtain Let's
-				// Encrypt certificates.
-				Hosts []string `yaml:"hosts,omitempty"`
-
-				// DirectoryURL points to the CA directory endpoint.
-				// If empty, LetsEncrypt is used.
-				DirectoryURL string `yaml:"directoryurl,omitempty"`
-			} `yaml:"letsencrypt,omitempty"`
 		} `yaml:"tls,omitempty"`
 
 		// Headers is a set of headers to include in HTTP responses. A common
@@ -149,25 +109,7 @@ type Configuration struct {
 		Debug struct {
 			// Addr specifies the bind address for the debug server.
 			Addr string `yaml:"addr,omitempty"`
-			// Prometheus configures the Prometheus telemetry endpoint.
-			Prometheus struct {
-				Enabled bool   `yaml:"enabled,omitempty"`
-				Path    string `yaml:"path,omitempty"`
-			} `yaml:"prometheus,omitempty"`
 		} `yaml:"debug,omitempty"`
-
-		// HTTP2 configuration options
-		HTTP2 struct {
-			// Specifies whether the registry should disallow clients attempting
-			// to connect via HTTP/2. If set to true, only HTTP/1.1 is supported.
-			Disabled bool `yaml:"disabled,omitempty"`
-		} `yaml:"http2,omitempty"`
-
-		H2C struct {
-			// Enables H2C (HTTP/2 Cleartext). Enable to support HTTP/2 without needing to configure TLS
-			// Useful when deploying the registry behind a load balancer (e.g. Cloud Run)
-			Enabled bool `yaml:"enabled,omitempty"`
-		} `yaml:"h2c,omitempty"`
 	} `yaml:"http,omitempty"`
 
 	// Notifications specifies configuration about various endpoint to which
@@ -175,38 +117,53 @@ type Configuration struct {
 	Notifications Notifications `yaml:"notifications,omitempty"`
 
 	// Redis configures the redis pool available to the registry webapp.
-	Redis Redis `yaml:"redis,omitempty"`
+	Redis struct {
+		// Addr specifies the the redis instance available to the application.
+		Addr string `yaml:"addr,omitempty"`
 
-	Health  Health  `yaml:"health,omitempty"`
-	Catalog Catalog `yaml:"catalog,omitempty"`
+		// Password string to use when making a connection.
+		Password string `yaml:"password,omitempty"`
+
+		// DB specifies the database to connect to on the redis instance.
+		DB int `yaml:"db,omitempty"`
+
+		DialTimeout  time.Duration `yaml:"dialtimeout,omitempty"`  // timeout for connect
+		ReadTimeout  time.Duration `yaml:"readtimeout,omitempty"`  // timeout for reads of data
+		WriteTimeout time.Duration `yaml:"writetimeout,omitempty"` // timeout for writes of data
+
+		// Pool configures the behavior of the redis connection pool.
+		Pool struct {
+			// MaxIdle sets the maximum number of idle connections.
+			MaxIdle int `yaml:"maxidle,omitempty"`
+
+			// MaxActive sets the maximum number of connections that should be
+			// opened before blocking a connection request.
+			MaxActive int `yaml:"maxactive,omitempty"`
+
+			// IdleTimeout sets the amount time to wait before closing
+			// inactive connections.
+			IdleTimeout time.Duration `yaml:"idletimeout,omitempty"`
+		} `yaml:"pool,omitempty"`
+	} `yaml:"redis,omitempty"`
+
+	Health Health `yaml:"health,omitempty"`
 
 	Proxy Proxy `yaml:"proxy,omitempty"`
 
-	// Validation configures validation options for the registry.
-	Validation Validation `yaml:"validation,omitempty"`
+	// Compatibility is used for configurations of working with older or deprecated features.
+	Compatibility struct {
+		// Schema1 configures how schema1 manifests will be handled
+		Schema1 struct {
+			// TrustKey is the signing key to use for adding the signature to
+			// schema1 manifests.
+			TrustKey string `yaml:"signingkeyfile,omitempty"`
 
-	// Policy configures registry policy options.
-	Policy struct {
-		// Repository configures policies for repositories
-		Repository struct {
-			// Classes is a list of repository classes which the
-			// registry allows content for. This class is matched
-			// against the configuration media type inside uploaded
-			// manifests. When non-empty, the registry will enforce
-			// the class in authorized resources.
-			Classes []string `yaml:"classes"`
-		} `yaml:"repository,omitempty"`
-	} `yaml:"policy,omitempty"`
-}
-
-// Catalog is composed of MaxEntries.
-// Catalog endpoint (/v2/_catalog) configuration, it provides the configuration
-// options to control the maximum number of entries returned by the catalog endpoint.
-type Catalog struct {
-	// Max number of entries returned by the catalog endpoint. Requesting n entries
-	// to the catalog endpoint will return at most MaxEntries entries.
-	// An empty or a negative value will set a default of 1000 maximum entries by default.
-	MaxEntries int `yaml:"maxentries,omitempty"`
+			// DisableSignatureStore will cause all signatures attached to schema1 manifests
+			// to be ignored. Signatures will be generated on all schema1 manifest requests
+			// rather than only requests which converted schema2 to schema1.
+			DisableSignatureStore bool `yaml:"disablesignaturestore,omitempty"`
+		} `yaml:"schema1,omitempty"`
+	} `yaml:"compatibility,omitempty"`
 }
 
 // LogHook is composed of hook Level and Type.
@@ -223,7 +180,7 @@ type LogHook struct {
 	// Levels set which levels of log message will let hook executed.
 	Levels []string `yaml:"levels,omitempty"`
 
-	// MailOptions allows user to configure email parameters.
+	// MailOptions allows user to configurate email parameters.
 	MailOptions MailOptions `yaml:"options,omitempty"`
 }
 
@@ -239,7 +196,7 @@ type MailOptions struct {
 		// Password defines password of login user
 		Password string `yaml:"password,omitempty"`
 
-		// Insecure defines if smtp login skips the secure certification.
+		// Insecure defines if smtp login skips the secure cerification.
 		Insecure bool `yaml:"insecure,omitempty"`
 	} `yaml:"smtp,omitempty"`
 
@@ -264,7 +221,7 @@ type FileChecker struct {
 // HTTPChecker is a type of entry in the health section for checking HTTP URIs.
 type HTTPChecker struct {
 	// Timeout is the duration to wait before timing out the HTTP request
-	Timeout time.Duration `yaml:"timeout,omitempty"`
+	Timeout time.Duration `yaml:"interval,omitempty"`
 	// StatusCode is the expected status code
 	StatusCode int
 	// Interval is the duration in between checks
@@ -281,7 +238,7 @@ type HTTPChecker struct {
 // TCPChecker is a type of entry in the health section for checking TCP servers.
 type TCPChecker struct {
 	// Timeout is the duration to wait before timing out the TCP connection
-	Timeout time.Duration `yaml:"timeout,omitempty"`
+	Timeout time.Duration `yaml:"interval,omitempty"`
 	// Interval is the duration in between checks
 	Interval time.Duration `yaml:"interval,omitempty"`
 	// Addr is the TCP address to check
@@ -312,19 +269,12 @@ type Health struct {
 	} `yaml:"storagedriver,omitempty"`
 }
 
-type Platform struct {
-	// Architecture is the architecture for this platform
-	Architecture string `yaml:"architecture,omitempty"`
-	// OS is the operating system for this platform
-	OS string `yaml:"os,omitempty"`
-}
-
 // v0_1Configuration is a Version 0.1 Configuration struct
 // This is currently aliased to Configuration, as it is the current version
 type v0_1Configuration Configuration
 
 // UnmarshalYAML implements the yaml.Unmarshaler interface
-// Unmarshals a string of the form X.Y into a Version, validating that X and Y can represent unsigned integers
+// Unmarshals a string of the form X.Y into a Version, validating that X and Y can represent uints
 func (version *Version) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	var versionString string
 	err := unmarshal(&versionString)
@@ -366,7 +316,7 @@ func (loglevel *Loglevel) UnmarshalYAML(unmarshal func(interface{}) error) error
 	switch loglevelString {
 	case "error", "warn", "info", "debug":
 	default:
-		return fmt.Errorf("invalid loglevel %s Must be one of [error, warn, info, debug]", loglevelString)
+		return fmt.Errorf("Invalid loglevel %s Must be one of [error, warn, info, debug]", loglevelString)
 	}
 
 	*loglevel = Loglevel(loglevelString)
@@ -394,8 +344,6 @@ func (storage Storage) Type() string {
 			// allow configuration of delete
 		case "redirect":
 			// allow configuration of redirect
-		case "tag":
-			// allow configuration of tag
 		default:
 			storageType = append(storageType, k)
 		}
@@ -409,19 +357,6 @@ func (storage Storage) Type() string {
 	return ""
 }
 
-// TagParameters returns the Parameters map for a Storage tag configuration
-func (storage Storage) TagParameters() Parameters {
-	return storage["tag"]
-}
-
-// setTagParameter changes the parameter at the provided key to the new value
-func (storage Storage) setTagParameter(key string, value interface{}) {
-	if _, ok := storage["tag"]; !ok {
-		storage["tag"] = make(Parameters)
-	}
-	storage["tag"][key] = value
-}
-
 // Parameters returns the Parameters map for a Storage configuration
 func (storage Storage) Parameters() Parameters {
 	return storage[storage.Type()]
@@ -450,15 +385,13 @@ func (storage *Storage) UnmarshalYAML(unmarshal func(interface{}) error) error {
 					// allow configuration of delete
 				case "redirect":
 					// allow configuration of redirect
-				case "tag":
-					// allow configuration of tag
 				default:
 					types = append(types, k)
 				}
 			}
 
 			if len(types) > 1 {
-				return fmt.Errorf("must provide exactly one storage type. Provided: %v", types)
+				return fmt.Errorf("Must provide exactly one storage type. Provided: %v", types)
 			}
 		}
 		*storage = storageMap
@@ -486,7 +419,7 @@ func (storage Storage) MarshalYAML() (interface{}, error) {
 // Auth defines the configuration for registry authorization.
 type Auth map[string]Parameters
 
-// Type returns the auth type, such as htpasswd or token
+// Type returns the storage driver type, such as filesystem or s3
 func (auth Auth) Type() string {
 	// Return only key in this map
 	for k := range auth {
@@ -546,8 +479,6 @@ func (auth Auth) MarshalYAML() (interface{}, error) {
 
 // Notifications configures multiple http endpoints.
 type Notifications struct {
-	// EventConfig is the configuration for the event format that is sent to each Endpoint.
-	EventConfig Events `yaml:"events,omitempty"`
 	// Endpoints is a list of http configurations for endpoints that
 	// respond to webhook notifications. In the future, we may allow other
 	// kinds of endpoints, such as external queues.
@@ -557,26 +488,42 @@ type Notifications struct {
 // Endpoint describes the configuration of an http webhook notification
 // endpoint.
 type Endpoint struct {
-	Name              string        `yaml:"name"`              // identifies the endpoint in the registry instance.
-	Disabled          bool          `yaml:"disabled"`          // disables the endpoint
-	URL               string        `yaml:"url"`               // post url for the endpoint.
-	Headers           http.Header   `yaml:"headers"`           // static headers that should be added to all requests
-	Timeout           time.Duration `yaml:"timeout"`           // HTTP timeout
-	Threshold         int           `yaml:"threshold"`         // circuit breaker threshold before backing off on failure
-	Backoff           time.Duration `yaml:"backoff"`           // backoff duration
-	IgnoredMediaTypes []string      `yaml:"ignoredmediatypes"` // target media types to ignore
-	Ignore            Ignore        `yaml:"ignore"`            // ignore event types
+	Name      string        `yaml:"name"`      // identifies the endpoint in the registry instance.
+	Disabled  bool          `yaml:"disabled"`  // disables the endpoint
+	URL       string        `yaml:"url"`       // post url for the endpoint.
+	Headers   http.Header   `yaml:"headers"`   // static headers that should be added to all requests
+	Timeout   time.Duration `yaml:"timeout"`   // HTTP timeout
+	Threshold int           `yaml:"threshold"` // circuit breaker threshold before backing off on failure
+	Backoff   time.Duration `yaml:"backoff"`   // backoff duration
 }
 
-// Events configures notification events.
-type Events struct {
-	IncludeReferences bool `yaml:"includereferences"` // include reference data in manifest events
+// Reporting defines error reporting methods.
+type Reporting struct {
+	// Bugsnag configures error reporting for Bugsnag (bugsnag.com).
+	Bugsnag BugsnagReporting `yaml:"bugsnag,omitempty"`
+	// NewRelic configures error reporting for NewRelic (newrelic.com)
+	NewRelic NewRelicReporting `yaml:"newrelic,omitempty"`
 }
 
-// Ignore configures mediaTypes and actions of the event, that it won't be propagated
-type Ignore struct {
-	MediaTypes []string `yaml:"mediatypes"` // target media types to ignore
-	Actions    []string `yaml:"actions"`    // ignore action types
+// BugsnagReporting configures error reporting for Bugsnag (bugsnag.com).
+type BugsnagReporting struct {
+	// APIKey is the Bugsnag api key.
+	APIKey string `yaml:"apikey,omitempty"`
+	// ReleaseStage tracks where the registry is deployed.
+	// Examples: production, staging, development
+	ReleaseStage string `yaml:"releasestage,omitempty"`
+	// Endpoint is used for specifying an enterprise Bugsnag endpoint.
+	Endpoint string `yaml:"endpoint,omitempty"`
+}
+
+// NewRelicReporting configures error reporting for NewRelic (newrelic.com)
+type NewRelicReporting struct {
+	// LicenseKey is the NewRelic user license key
+	LicenseKey string `yaml:"licensekey,omitempty"`
+	// Name is the component name of the registry in NewRelic
+	Name string `yaml:"name,omitempty"`
+	// Verbose configures debug output to STDOUT
+	Verbose bool `yaml:"verbose,omitempty"`
 }
 
 // Middleware configures named middlewares to be applied at injection points.
@@ -599,67 +546,6 @@ type Proxy struct {
 
 	// Password of the hub user
 	Password string `yaml:"password"`
-
-	// TTL is the expiry time of the content and will be cleaned up when it expires
-	// if not set, defaults to 7 * 24 hours
-	// If set to zero, will never expire cache
-	TTL *time.Duration `yaml:"ttl,omitempty"`
-}
-
-type Validation struct {
-	// Enabled enables the other options in this section. This field is
-	// deprecated in favor of Disabled.
-	Enabled bool `yaml:"enabled,omitempty"`
-	// Disabled disables the other options in this section.
-	Disabled bool `yaml:"disabled,omitempty"`
-	// Manifests configures manifest validation.
-	Manifests ValidationManifests `yaml:"manifests,omitempty"`
-}
-
-type ValidationManifests struct {
-	// URLs configures validation for URLs in pushed manifests.
-	URLs struct {
-		// Allow specifies regular expressions (https://godoc.org/regexp/syntax)
-		// that URLs in pushed manifests must match.
-		Allow []string `yaml:"allow,omitempty"`
-		// Deny specifies regular expressions (https://godoc.org/regexp/syntax)
-		// that URLs in pushed manifests must not match.
-		Deny []string `yaml:"deny,omitempty"`
-	} `yaml:"urls,omitempty"`
-	// ImageIndexes configures validation of image indexes
-	Indexes ValidationIndexes `yaml:"indexes,omitempty"`
-}
-
-type ValidationIndexes struct {
-	// Platforms configures the validation applies to the platform images included in an image index
-	Platforms Platforms `yaml:"platforms"`
-	// PlatformList filters the set of platforms to validate for image existence.
-	PlatformList []Platform `yaml:"platformlist,omitempty"`
-}
-
-// Platforms configures the validation applies to the platform images included in an image index
-// This can be all, none, or list
-type Platforms string
-
-// UnmarshalYAML implements the yaml.Umarshaler interface
-// Unmarshals a string into a Platforms option, lowercasing the string and validating that it represents a
-// valid option
-func (platforms *Platforms) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	var platformsString string
-	err := unmarshal(&platformsString)
-	if err != nil {
-		return err
-	}
-
-	platformsString = strings.ToLower(platformsString)
-	switch platformsString {
-	case "all", "none", "list":
-	default:
-		return fmt.Errorf("invalid platforms option %s Must be one of [all, none, list]", platformsString)
-	}
-
-	*platforms = Platforms(platformsString)
-	return nil
 }
 
 // Parse parses an input configuration yaml document into a Configuration struct
@@ -670,7 +556,7 @@ func (platforms *Platforms) UnmarshalYAML(unmarshal func(interface{}) error) err
 // Configuration.Abc may be replaced by the value of REGISTRY_ABC,
 // Configuration.Abc.Xyz may be replaced by the value of REGISTRY_ABC_XYZ, and so forth
 func Parse(rd io.Reader) (*Configuration, error) {
-	in, err := io.ReadAll(rd)
+	in, err := ioutil.ReadAll(rd)
 	if err != nil {
 		return nil, err
 	}
@@ -681,27 +567,15 @@ func Parse(rd io.Reader) (*Configuration, error) {
 			ParseAs: reflect.TypeOf(v0_1Configuration{}),
 			ConversionFunc: func(c interface{}) (interface{}, error) {
 				if v0_1, ok := c.(*v0_1Configuration); ok {
-					if v0_1.Log.Level == Loglevel("") {
-						if v0_1.Loglevel != Loglevel("") {
-							v0_1.Log.Level = v0_1.Loglevel
-						} else {
-							v0_1.Log.Level = Loglevel("info")
-						}
+					if v0_1.Loglevel == Loglevel("") {
+						v0_1.Loglevel = Loglevel("info")
 					}
-					if v0_1.Loglevel != Loglevel("") {
-						v0_1.Loglevel = Loglevel("")
-					}
-
-					if v0_1.Catalog.MaxEntries <= 0 {
-						v0_1.Catalog.MaxEntries = 1000
-					}
-
 					if v0_1.Storage.Type() == "" {
-						return nil, errors.New("no storage configuration provided")
+						return nil, fmt.Errorf("No storage configuration provided")
 					}
 					return (*Configuration)(v0_1), nil
 				}
-				return nil, fmt.Errorf("expected *v0_1Configuration, received %#v", c)
+				return nil, fmt.Errorf("Expected *v0_1Configuration, received %#v", c)
 			},
 		},
 	})
@@ -714,172 +588,3 @@ func Parse(rd io.Reader) (*Configuration, error) {
 
 	return config, nil
 }
-
-type RedisOptions = redis.UniversalOptions
-
-type RedisTLSOptions struct {
-	Certificate string   `yaml:"certificate,omitempty"`
-	Key         string   `yaml:"key,omitempty"`
-	ClientCAs   []string `yaml:"clientcas,omitempty"`
-}
-
-type Redis struct {
-	Options RedisOptions    `yaml:",inline"`
-	TLS     RedisTLSOptions `yaml:"tls,omitempty"`
-}
-
-func (c Redis) MarshalYAML() (interface{}, error) {
-	fields := make(map[string]interface{})
-
-	val := reflect.ValueOf(c.Options)
-	typ := val.Type()
-
-	for i := 0; i < val.NumField(); i++ {
-		field := typ.Field(i)
-		fieldValue := val.Field(i)
-
-		// ignore funcs fields in redis.UniversalOptions
-		if fieldValue.Kind() == reflect.Func {
-			continue
-		}
-
-		fields[strings.ToLower(field.Name)] = fieldValue.Interface()
-	}
-
-	// Add TLS fields if they're not empty
-	if c.TLS.Certificate != "" || c.TLS.Key != "" || len(c.TLS.ClientCAs) > 0 {
-		fields["tls"] = c.TLS
-	}
-
-	return fields, nil
-}
-
-func (c *Redis) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	var fields map[string]interface{}
-	err := unmarshal(&fields)
-	if err != nil {
-		return err
-	}
-
-	val := reflect.ValueOf(&c.Options).Elem()
-	typ := val.Type()
-
-	for i := 0; i < typ.NumField(); i++ {
-		field := typ.Field(i)
-		fieldName := strings.ToLower(field.Name)
-
-		if value, ok := fields[fieldName]; ok {
-			fieldValue := val.Field(i)
-			if fieldValue.CanSet() {
-				switch field.Type {
-				case reflect.TypeOf(time.Duration(0)):
-					durationStr, ok := value.(string)
-					if !ok {
-						return fmt.Errorf("invalid duration value for field: %s", fieldName)
-					}
-					duration, err := time.ParseDuration(durationStr)
-					if err != nil {
-						return fmt.Errorf("failed to parse duration for field: %s, error: %v", fieldName, err)
-					}
-					fieldValue.Set(reflect.ValueOf(duration))
-				default:
-					if err := setFieldValue(fieldValue, value); err != nil {
-						return fmt.Errorf("failed to set value for field: %s, error: %v", fieldName, err)
-					}
-				}
-			}
-		}
-	}
-
-	// Handle TLS fields
-	if tlsData, ok := fields["tls"]; ok {
-		tlsMap, ok := tlsData.(map[interface{}]interface{})
-		if !ok {
-			return fmt.Errorf("invalid TLS data structure")
-		}
-
-		if cert, ok := tlsMap["certificate"]; ok {
-			var isString bool
-			c.TLS.Certificate, isString = cert.(string)
-			if !isString {
-				return fmt.Errorf("Redis TLS certificate must be a string")
-			}
-		}
-		if key, ok := tlsMap["key"]; ok {
-			var isString bool
-			c.TLS.Key, isString = key.(string)
-			if !isString {
-				return fmt.Errorf("Redis TLS (private) key must be a string")
-			}
-		}
-		if cas, ok := tlsMap["clientcas"]; ok {
-			caList, ok := cas.([]interface{})
-			if !ok {
-				return fmt.Errorf("invalid clientcas data structure")
-			}
-			for _, ca := range caList {
-				if caStr, ok := ca.(string); ok {
-					c.TLS.ClientCAs = append(c.TLS.ClientCAs, caStr)
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-func setFieldValue(field reflect.Value, value interface{}) error {
-	if value == nil {
-		return nil
-	}
-
-	switch field.Kind() {
-	case reflect.String:
-		stringValue, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("failed to convert value to string")
-		}
-		field.SetString(stringValue)
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		intValue, ok := value.(int)
-		if !ok {
-			return fmt.Errorf("failed to convert value to integer")
-		}
-		field.SetInt(int64(intValue))
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		uintValue, ok := value.(uint)
-		if !ok {
-			return fmt.Errorf("failed to convert value to unsigned integer")
-		}
-		field.SetUint(uint64(uintValue))
-	case reflect.Float32, reflect.Float64:
-		floatValue, ok := value.(float64)
-		if !ok {
-			return fmt.Errorf("failed to convert value to float")
-		}
-		field.SetFloat(floatValue)
-	case reflect.Bool:
-		boolValue, ok := value.(bool)
-		if !ok {
-			return fmt.Errorf("failed to convert value to boolean")
-		}
-		field.SetBool(boolValue)
-	case reflect.Slice:
-		slice := reflect.MakeSlice(field.Type(), 0, 0)
-		valueSlice, ok := value.([]interface{})
-		if !ok {
-			return fmt.Errorf("failed to convert value to slice")
-		}
-		for _, item := range valueSlice {
-			sliceValue := reflect.New(field.Type().Elem()).Elem()
-			if err := setFieldValue(sliceValue, item); err != nil {
-				return err
-			}
-			slice = reflect.Append(slice, sliceValue)
-		}
-		field.Set(slice)
-	default:
-		return fmt.Errorf("unsupported field type: %v", field.Type())
-	}
-	return nil
-}

configuration/configuration_test.go

@@ -3,45 +3,41 @@ package configuration
 import (
 	"bytes"
 	"net/http"
+	"os"
 	"reflect"
 	"strings"
 	"testing"
-	"time"
 
-	"github.com/redis/go-redis/v9"
-	"github.com/stretchr/testify/suite"
+	. "gopkg.in/check.v1"
 	"gopkg.in/yaml.v2"
 )
 
+// Hook up gocheck into the "go test" runner
+func Test(t *testing.T) { TestingT(t) }
+
 // configStruct is a canonical example configuration, which should map to configYamlV0_1
 var configStruct = Configuration{
 	Version: "0.1",
 	Log: struct {
-		AccessLog struct {
-			Disabled bool `yaml:"disabled,omitempty"`
-		} `yaml:"accesslog,omitempty"`
-		Level        Loglevel               `yaml:"level,omitempty"`
-		Formatter    string                 `yaml:"formatter,omitempty"`
-		Fields       map[string]interface{} `yaml:"fields,omitempty"`
-		Hooks        []LogHook              `yaml:"hooks,omitempty"`
-		ReportCaller bool                   `yaml:"reportcaller,omitempty"`
+		Level     Loglevel               `yaml:"level"`
+		Formatter string                 `yaml:"formatter,omitempty"`
+		Fields    map[string]interface{} `yaml:"fields,omitempty"`
+		Hooks     []LogHook              `yaml:"hooks,omitempty"`
 	}{
-		Level:  "info",
 		Fields: map[string]interface{}{"environment": "test"},
 	},
+	Loglevel: "info",
 	Storage: Storage{
-		"somedriver": Parameters{
-			"string1": "string-value1",
-			"string2": "string-value2",
-			"bool1":   true,
-			"bool2":   false,
-			"nil1":    nil,
-			"int1":    42,
-			"url1":    "https://foo.example.com",
-			"path1":   "/some-path",
-		},
-		"tag": Parameters{
-			"concurrencylimit": 10,
+		"s3": Parameters{
+			"region":        "us-east-1",
+			"bucket":        "my-bucket",
+			"rootdirectory": "/registry",
+			"encrypt":       true,
+			"secure":        false,
+			"accesskey":     "SAMPLEACCESSKEY",
+			"secretkey":     "SUPERSECRET",
+			"host":          nil,
+			"port":          42,
 		},
 	},
 	Auth: Auth{
@@ -50,6 +46,11 @@ var configStruct = Configuration{
 			"service": "silly",
 		},
 	},
+	Reporting: Reporting{
+		Bugsnag: BugsnagReporting{
+			APIKey: "BugsnagApiKey",
+		},
+	},
 	Notifications: Notifications{
 		Endpoints: []Endpoint{
 			{
@@ -58,129 +59,57 @@ var configStruct = Configuration{
 				Headers: http.Header{
 					"Authorization": []string{"Bearer <example>"},
 				},
-				IgnoredMediaTypes: []string{"application/octet-stream"},
-				Ignore: Ignore{
-					MediaTypes: []string{"application/octet-stream"},
-					Actions:    []string{"pull"},
-				},
 			},
 		},
 	},
-	Catalog: Catalog{
-		MaxEntries: 1000,
-	},
 	HTTP: struct {
-		Addr         string        `yaml:"addr,omitempty"`
-		Net          string        `yaml:"net,omitempty"`
-		Host         string        `yaml:"host,omitempty"`
-		Prefix       string        `yaml:"prefix,omitempty"`
-		Secret       string        `yaml:"secret,omitempty"`
-		RelativeURLs bool          `yaml:"relativeurls,omitempty"`
-		DrainTimeout time.Duration `yaml:"draintimeout,omitempty"`
+		Addr         string `yaml:"addr,omitempty"`
+		Net          string `yaml:"net,omitempty"`
+		Host         string `yaml:"host,omitempty"`
+		Prefix       string `yaml:"prefix,omitempty"`
+		Secret       string `yaml:"secret,omitempty"`
+		RelativeURLs bool   `yaml:"relativeurls,omitempty"`
 		TLS          struct {
-			Certificate  string   `yaml:"certificate,omitempty"`
-			Key          string   `yaml:"key,omitempty"`
-			ClientCAs    []string `yaml:"clientcas,omitempty"`
-			MinimumTLS   string   `yaml:"minimumtls,omitempty"`
-			CipherSuites []string `yaml:"ciphersuites,omitempty"`
-			LetsEncrypt  struct {
-				CacheFile    string   `yaml:"cachefile,omitempty"`
-				Email        string   `yaml:"email,omitempty"`
-				Hosts        []string `yaml:"hosts,omitempty"`
-				DirectoryURL string   `yaml:"directoryurl,omitempty"`
-			} `yaml:"letsencrypt,omitempty"`
+			Certificate string   `yaml:"certificate,omitempty"`
+			Key         string   `yaml:"key,omitempty"`
+			ClientCAs   []string `yaml:"clientcas,omitempty"`
 		} `yaml:"tls,omitempty"`
 		Headers http.Header `yaml:"headers,omitempty"`
 		Debug   struct {
-			Addr       string `yaml:"addr,omitempty"`
-			Prometheus struct {
-				Enabled bool   `yaml:"enabled,omitempty"`
-				Path    string `yaml:"path,omitempty"`
-			} `yaml:"prometheus,omitempty"`
+			Addr string `yaml:"addr,omitempty"`
 		} `yaml:"debug,omitempty"`
-		HTTP2 struct {
-			Disabled bool `yaml:"disabled,omitempty"`
-		} `yaml:"http2,omitempty"`
-		H2C struct {
-			Enabled bool `yaml:"enabled,omitempty"`
-		} `yaml:"h2c,omitempty"`
 	}{
 		TLS: struct {
-			Certificate  string   `yaml:"certificate,omitempty"`
-			Key          string   `yaml:"key,omitempty"`
-			ClientCAs    []string `yaml:"clientcas,omitempty"`
-			MinimumTLS   string   `yaml:"minimumtls,omitempty"`
-			CipherSuites []string `yaml:"ciphersuites,omitempty"`
-			LetsEncrypt  struct {
-				CacheFile    string   `yaml:"cachefile,omitempty"`
-				Email        string   `yaml:"email,omitempty"`
-				Hosts        []string `yaml:"hosts,omitempty"`
-				DirectoryURL string   `yaml:"directoryurl,omitempty"`
-			} `yaml:"letsencrypt,omitempty"`
+			Certificate string   `yaml:"certificate,omitempty"`
+			Key         string   `yaml:"key,omitempty"`
+			ClientCAs   []string `yaml:"clientcas,omitempty"`
 		}{
 			ClientCAs: []string{"/path/to/ca.pem"},
 		},
 		Headers: http.Header{
 			"X-Content-Type-Options": []string{"nosniff"},
 		},
-		HTTP2: struct {
-			Disabled bool `yaml:"disabled,omitempty"`
-		}{
-			Disabled: false,
-		},
-		H2C: struct {
-			Enabled bool `yaml:"enabled,omitempty"`
-		}{
-			Enabled: true,
-		},
-	},
-	Redis: Redis{
-		Options: redis.UniversalOptions{
-			Addrs:           []string{"localhost:6379"},
-			Username:        "alice",
-			Password:        "123456",
-			DB:              1,
-			MaxIdleConns:    16,
-			PoolSize:        64,
-			ConnMaxIdleTime: time.Second * 300,
-			DialTimeout:     time.Millisecond * 10,
-			ReadTimeout:     time.Millisecond * 10,
-			WriteTimeout:    time.Millisecond * 10,
-		},
-		TLS: RedisTLSOptions{
-			Certificate: "/foo/cert.crt",
-			Key:         "/foo/key.pem",
-			ClientCAs:   []string{"/path/to/ca.pem"},
-		},
-	},
-	Validation: Validation{
-		Manifests: ValidationManifests{
-			Indexes: ValidationIndexes{
-				Platforms: "none",
-			},
-		},
 	},
 }
 
 // configYamlV0_1 is a Version 0.1 yaml document representing configStruct
-const configYamlV0_1 = `
+var configYamlV0_1 = `
 version: 0.1
 log:
-  level: info
   fields:
     environment: test
+loglevel: info
 storage:
-  somedriver:
-    string1: string-value1
-    string2: string-value2
-    bool1: true
-    bool2: false
-    nil1: ~
-    int1: 42
-    url1: "https://foo.example.com"
-    path1: "/some-path"
-  tag:
-    concurrencylimit: 10
+  s3:
+    region: us-east-1
+    bucket: my-bucket
+    rootdirectory: /registry
+    encrypt: true
+    secure: false
+    accesskey: SAMPLEACCESSKEY
+    secretkey: SUPERSECRET
+    host: ~
+    port: 42
 auth:
   silly:
     realm: silly
@@ -191,47 +120,21 @@ notifications:
       url:  http://example.com
       headers:
         Authorization: [Bearer <example>]
-      ignoredmediatypes:
-        - application/octet-stream
-      ignore:
-        mediatypes:
-           - application/octet-stream
-        actions:
-           - pull
+reporting:
+  bugsnag:
+    apikey: BugsnagApiKey
 http:
-  tls:
-    clientcas:
-      - /path/to/ca.pem
+  clientcas:
+    - /path/to/ca.pem
   headers:
     X-Content-Type-Options: [nosniff]
-redis:
-  tls:
-    certificate: /foo/cert.crt
-    key: /foo/key.pem
-    clientcas:
-      - /path/to/ca.pem
-  addrs: [localhost:6379]
-  username: alice
-  password: "123456"
-  db: 1
-  maxidleconns: 16
-  poolsize: 64
-  connmaxidletime: 300s
-  dialtimeout: 10ms
-  readtimeout: 10ms
-  writetimeout: 10ms
-validation:
-  manifests:
-    indexes:
-      platforms: none
 `
 
 // inmemoryConfigYamlV0_1 is a Version 0.1 yaml document specifying an inmemory
 // storage driver with no parameters
-const inmemoryConfigYamlV0_1 = `
+var inmemoryConfigYamlV0_1 = `
 version: 0.1
-log:
-  level: info
+loglevel: info
 storage: inmemory
 auth:
   silly:
@@ -243,214 +146,223 @@ notifications:
       url:  http://example.com
       headers:
         Authorization: [Bearer <example>]
-      ignoredmediatypes:
-        - application/octet-stream
-      ignore:
-        mediatypes:
-           - application/octet-stream
-        actions:
-           - pull
 http:
   headers:
     X-Content-Type-Options: [nosniff]
-validation:
-  manifests:
-    indexes:
-      platforms: none
 `
 
 type ConfigSuite struct {
-	suite.Suite
 	expectedConfig *Configuration
 }
 
-func TestConfigSuite(t *testing.T) {
-	suite.Run(t, new(ConfigSuite))
-}
+var _ = Suite(new(ConfigSuite))
 
-func (suite *ConfigSuite) SetupTest() {
+func (suite *ConfigSuite) SetUpTest(c *C) {
+	os.Clearenv()
 	suite.expectedConfig = copyConfig(configStruct)
 }
 
 // TestMarshalRoundtrip validates that configStruct can be marshaled and
 // unmarshaled without changing any parameters
-func (suite *ConfigSuite) TestMarshalRoundtrip() {
+func (suite *ConfigSuite) TestMarshalRoundtrip(c *C) {
 	configBytes, err := yaml.Marshal(suite.expectedConfig)
-	suite.Require().NoError(err)
+	c.Assert(err, IsNil)
 	config, err := Parse(bytes.NewReader(configBytes))
-	suite.T().Log(string(configBytes))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseSimple validates that configYamlV0_1 can be parsed into a struct
 // matching configStruct
-func (suite *ConfigSuite) TestParseSimple() {
+func (suite *ConfigSuite) TestParseSimple(c *C) {
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseInmemory validates that configuration yaml with storage provided as
 // a string can be parsed into a Configuration struct with no storage parameters
-func (suite *ConfigSuite) TestParseInmemory() {
+func (suite *ConfigSuite) TestParseInmemory(c *C) {
 	suite.expectedConfig.Storage = Storage{"inmemory": Parameters{}}
+	suite.expectedConfig.Reporting = Reporting{}
 	suite.expectedConfig.Log.Fields = nil
-	suite.expectedConfig.HTTP.TLS.ClientCAs = nil
-	suite.expectedConfig.Redis = Redis{}
 
 	config, err := Parse(bytes.NewReader([]byte(inmemoryConfigYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseIncomplete validates that an incomplete yaml configuration cannot
 // be parsed without providing environment variables to fill in the missing
 // components.
-func (suite *ConfigSuite) TestParseIncomplete() {
+func (suite *ConfigSuite) TestParseIncomplete(c *C) {
 	incompleteConfigYaml := "version: 0.1"
 	_, err := Parse(bytes.NewReader([]byte(incompleteConfigYaml)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 
 	suite.expectedConfig.Log.Fields = nil
 	suite.expectedConfig.Storage = Storage{"filesystem": Parameters{"rootdirectory": "/tmp/testroot"}}
 	suite.expectedConfig.Auth = Auth{"silly": Parameters{"realm": "silly"}}
+	suite.expectedConfig.Reporting = Reporting{}
 	suite.expectedConfig.Notifications = Notifications{}
 	suite.expectedConfig.HTTP.Headers = nil
-	suite.expectedConfig.HTTP.TLS.ClientCAs = nil
-	suite.expectedConfig.Redis = Redis{}
-	suite.expectedConfig.Validation.Manifests.Indexes.Platforms = ""
 
 	// Note: this also tests that REGISTRY_STORAGE and
 	// REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY can be used together
-	suite.T().Setenv("REGISTRY_STORAGE", "filesystem")
-	suite.T().Setenv("REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY", "/tmp/testroot")
-	suite.T().Setenv("REGISTRY_AUTH", "silly")
-	suite.T().Setenv("REGISTRY_AUTH_SILLY_REALM", "silly")
+	os.Setenv("REGISTRY_STORAGE", "filesystem")
+	os.Setenv("REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY", "/tmp/testroot")
+	os.Setenv("REGISTRY_AUTH", "silly")
+	os.Setenv("REGISTRY_AUTH_SILLY_REALM", "silly")
 
 	config, err := Parse(bytes.NewReader([]byte(incompleteConfigYaml)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithSameEnvStorage validates that providing environment variables
 // that match the given storage type will only include environment-defined
 // parameters and remove yaml-defined parameters
-func (suite *ConfigSuite) TestParseWithSameEnvStorage() {
-	suite.expectedConfig.Storage = Storage{"somedriver": Parameters{"region": "us-east-1"}}
+func (suite *ConfigSuite) TestParseWithSameEnvStorage(c *C) {
+	suite.expectedConfig.Storage = Storage{"s3": Parameters{"region": "us-east-1"}}
 
-	suite.T().Setenv("REGISTRY_STORAGE", "somedriver")
-	suite.T().Setenv("REGISTRY_STORAGE_SOMEDRIVER_REGION", "us-east-1")
+	os.Setenv("REGISTRY_STORAGE", "s3")
+	os.Setenv("REGISTRY_STORAGE_S3_REGION", "us-east-1")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithDifferentEnvStorageParams validates that providing environment variables that change
 // and add to the given storage parameters will change and add parameters to the parsed
 // Configuration struct
-func (suite *ConfigSuite) TestParseWithDifferentEnvStorageParams() {
-	suite.expectedConfig.Storage.setParameter("string1", "us-west-1")
-	suite.expectedConfig.Storage.setParameter("bool1", true)
+func (suite *ConfigSuite) TestParseWithDifferentEnvStorageParams(c *C) {
+	suite.expectedConfig.Storage.setParameter("region", "us-west-1")
+	suite.expectedConfig.Storage.setParameter("secure", true)
 	suite.expectedConfig.Storage.setParameter("newparam", "some Value")
 
-	suite.T().Setenv("REGISTRY_STORAGE_SOMEDRIVER_STRING1", "us-west-1")
-	suite.T().Setenv("REGISTRY_STORAGE_SOMEDRIVER_BOOL1", "true")
-	suite.T().Setenv("REGISTRY_STORAGE_SOMEDRIVER_NEWPARAM", "some Value")
+	os.Setenv("REGISTRY_STORAGE_S3_REGION", "us-west-1")
+	os.Setenv("REGISTRY_STORAGE_S3_SECURE", "true")
+	os.Setenv("REGISTRY_STORAGE_S3_NEWPARAM", "some Value")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithDifferentEnvStorageType validates that providing an environment variable that
 // changes the storage type will be reflected in the parsed Configuration struct
-func (suite *ConfigSuite) TestParseWithDifferentEnvStorageType() {
+func (suite *ConfigSuite) TestParseWithDifferentEnvStorageType(c *C) {
 	suite.expectedConfig.Storage = Storage{"inmemory": Parameters{}}
 
-	suite.T().Setenv("REGISTRY_STORAGE", "inmemory")
+	os.Setenv("REGISTRY_STORAGE", "inmemory")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithDifferentEnvStorageTypeAndParams validates that providing an environment variable
 // that changes the storage type will be reflected in the parsed Configuration struct and that
 // environment storage parameters will also be included
-func (suite *ConfigSuite) TestParseWithDifferentEnvStorageTypeAndParams() {
+func (suite *ConfigSuite) TestParseWithDifferentEnvStorageTypeAndParams(c *C) {
 	suite.expectedConfig.Storage = Storage{"filesystem": Parameters{}}
 	suite.expectedConfig.Storage.setParameter("rootdirectory", "/tmp/testroot")
 
-	suite.T().Setenv("REGISTRY_STORAGE", "filesystem")
-	suite.T().Setenv("REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY", "/tmp/testroot")
+	os.Setenv("REGISTRY_STORAGE", "filesystem")
+	os.Setenv("REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY", "/tmp/testroot")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithSameEnvLoglevel validates that providing an environment variable defining the log
 // level to the same as the one provided in the yaml will not change the parsed Configuration struct
-func (suite *ConfigSuite) TestParseWithSameEnvLoglevel() {
-	suite.T().Setenv("REGISTRY_LOGLEVEL", "info")
+func (suite *ConfigSuite) TestParseWithSameEnvLoglevel(c *C) {
+	os.Setenv("REGISTRY_LOGLEVEL", "info")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseWithDifferentEnvLoglevel validates that providing an environment variable defining the
 // log level will override the value provided in the yaml document
-func (suite *ConfigSuite) TestParseWithDifferentEnvLoglevel() {
-	suite.expectedConfig.Log.Level = "error"
+func (suite *ConfigSuite) TestParseWithDifferentEnvLoglevel(c *C) {
+	suite.expectedConfig.Loglevel = "error"
 
-	suite.T().Setenv("REGISTRY_LOG_LEVEL", "error")
+	os.Setenv("REGISTRY_LOGLEVEL", "error")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseInvalidLoglevel validates that the parser will fail to parse a
 // configuration if the loglevel is malformed
-func (suite *ConfigSuite) TestParseInvalidLoglevel() {
+func (suite *ConfigSuite) TestParseInvalidLoglevel(c *C) {
 	invalidConfigYaml := "version: 0.1\nloglevel: derp\nstorage: inmemory"
 	_, err := Parse(bytes.NewReader([]byte(invalidConfigYaml)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 
-	suite.T().Setenv("REGISTRY_LOGLEVEL", "derp")
+	os.Setenv("REGISTRY_LOGLEVEL", "derp")
 
 	_, err = Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
+
+}
+
+// TestParseWithDifferentEnvReporting validates that environment variables
+// properly override reporting parameters
+func (suite *ConfigSuite) TestParseWithDifferentEnvReporting(c *C) {
+	suite.expectedConfig.Reporting.Bugsnag.APIKey = "anotherBugsnagApiKey"
+	suite.expectedConfig.Reporting.Bugsnag.Endpoint = "localhost:8080"
+	suite.expectedConfig.Reporting.NewRelic.LicenseKey = "NewRelicLicenseKey"
+	suite.expectedConfig.Reporting.NewRelic.Name = "some NewRelic NAME"
+
+	os.Setenv("REGISTRY_REPORTING_BUGSNAG_APIKEY", "anotherBugsnagApiKey")
+	os.Setenv("REGISTRY_REPORTING_BUGSNAG_ENDPOINT", "localhost:8080")
+	os.Setenv("REGISTRY_REPORTING_NEWRELIC_LICENSEKEY", "NewRelicLicenseKey")
+	os.Setenv("REGISTRY_REPORTING_NEWRELIC_NAME", "some NewRelic NAME")
+
+	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseInvalidVersion validates that the parser will fail to parse a newer configuration
 // version than the CurrentVersion
-func (suite *ConfigSuite) TestParseInvalidVersion() {
+func (suite *ConfigSuite) TestParseInvalidVersion(c *C) {
 	suite.expectedConfig.Version = MajorMinorVersion(CurrentVersion.Major(), CurrentVersion.Minor()+1)
 	configBytes, err := yaml.Marshal(suite.expectedConfig)
-	suite.Require().NoError(err)
+	c.Assert(err, IsNil)
 	_, err = Parse(bytes.NewReader(configBytes))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 }
 
 // TestParseExtraneousVars validates that environment variables referring to
 // nonexistent variables don't cause side effects.
-func (suite *ConfigSuite) TestParseExtraneousVars() {
+func (suite *ConfigSuite) TestParseExtraneousVars(c *C) {
+	suite.expectedConfig.Reporting.Bugsnag.Endpoint = "localhost:8080"
+
+	// A valid environment variable
+	os.Setenv("REGISTRY_REPORTING_BUGSNAG_ENDPOINT", "localhost:8080")
+
 	// Environment variables which shouldn't set config items
-	suite.T().Setenv("REGISTRY_DUCKS", "quack")
-	suite.T().Setenv("REGISTRY_REPORTING_ASDF", "ghjk")
+	os.Setenv("registry_REPORTING_NEWRELIC_LICENSEKEY", "NewRelicLicenseKey")
+	os.Setenv("REPORTING_NEWRELIC_NAME", "some NewRelic NAME")
+	os.Setenv("REGISTRY_DUCKS", "quack")
+	os.Setenv("REGISTRY_REPORTING_ASDF", "ghjk")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseEnvVarImplicitMaps validates that environment variables can set
 // values in maps that don't already exist.
-func (suite *ConfigSuite) TestParseEnvVarImplicitMaps() {
+func (suite *ConfigSuite) TestParseEnvVarImplicitMaps(c *C) {
 	readonly := make(map[string]interface{})
 	readonly["enabled"] = true
 
@@ -459,63 +371,61 @@ func (suite *ConfigSuite) TestParseEnvVarImplicitMaps() {
 
 	suite.expectedConfig.Storage["maintenance"] = maintenance
 
-	suite.T().Setenv("REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED", "true")
+	os.Setenv("REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED", "true")
 
 	config, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
-	suite.Require().Equal(suite.expectedConfig, config)
+	c.Assert(err, IsNil)
+	c.Assert(config, DeepEquals, suite.expectedConfig)
 }
 
 // TestParseEnvWrongTypeMap validates that incorrectly attempting to unmarshal a
 // string over existing map fails.
-func (suite *ConfigSuite) TestParseEnvWrongTypeMap() {
-	suite.T().Setenv("REGISTRY_STORAGE_SOMEDRIVER", "somestring")
+func (suite *ConfigSuite) TestParseEnvWrongTypeMap(c *C) {
+	os.Setenv("REGISTRY_STORAGE_S3", "somestring")
 
 	_, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 }
 
 // TestParseEnvWrongTypeStruct validates that incorrectly attempting to
 // unmarshal a string into a struct fails.
-func (suite *ConfigSuite) TestParseEnvWrongTypeStruct() {
-	suite.T().Setenv("REGISTRY_STORAGE_LOG", "somestring")
+func (suite *ConfigSuite) TestParseEnvWrongTypeStruct(c *C) {
+	os.Setenv("REGISTRY_STORAGE_LOG", "somestring")
 
 	_, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 }
 
 // TestParseEnvWrongTypeSlice validates that incorrectly attempting to
 // unmarshal a string into a slice fails.
-func (suite *ConfigSuite) TestParseEnvWrongTypeSlice() {
-	suite.T().Setenv("REGISTRY_LOG_HOOKS", "somestring")
+func (suite *ConfigSuite) TestParseEnvWrongTypeSlice(c *C) {
+	os.Setenv("REGISTRY_LOG_HOOKS", "somestring")
 
 	_, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().Error(err)
+	c.Assert(err, NotNil)
 }
 
 // TestParseEnvMany tests several environment variable overrides.
 // The result is not checked - the goal of this test is to detect panics
 // from misuse of reflection.
-func (suite *ConfigSuite) TestParseEnvMany() {
-	suite.T().Setenv("REGISTRY_VERSION", "0.1")
-	suite.T().Setenv("REGISTRY_LOG_LEVEL", "debug")
-	suite.T().Setenv("REGISTRY_LOG_FORMATTER", "json")
-	suite.T().Setenv("REGISTRY_LOG_HOOKS", "json")
-	suite.T().Setenv("REGISTRY_LOG_FIELDS", "abc: xyz")
-	suite.T().Setenv("REGISTRY_LOG_HOOKS", "- type: asdf")
-	suite.T().Setenv("REGISTRY_LOGLEVEL", "debug")
-	suite.T().Setenv("REGISTRY_STORAGE", "somedriver")
-	suite.T().Setenv("REGISTRY_AUTH_PARAMS", "param1: value1")
-	suite.T().Setenv("REGISTRY_AUTH_PARAMS_VALUE2", "value2")
-	suite.T().Setenv("REGISTRY_AUTH_PARAMS_VALUE2", "value2")
+func (suite *ConfigSuite) TestParseEnvMany(c *C) {
+	os.Setenv("REGISTRY_VERSION", "0.1")
+	os.Setenv("REGISTRY_LOG_LEVEL", "debug")
+	os.Setenv("REGISTRY_LOG_FORMATTER", "json")
+	os.Setenv("REGISTRY_LOG_HOOKS", "json")
+	os.Setenv("REGISTRY_LOG_FIELDS", "abc: xyz")
+	os.Setenv("REGISTRY_LOG_HOOKS", "- type: asdf")
+	os.Setenv("REGISTRY_LOGLEVEL", "debug")
+	os.Setenv("REGISTRY_STORAGE", "s3")
+	os.Setenv("REGISTRY_AUTH_PARAMS", "param1: value1")
+	os.Setenv("REGISTRY_AUTH_PARAMS_VALUE2", "value2")
+	os.Setenv("REGISTRY_AUTH_PARAMS_VALUE2", "value2")
 
 	_, err := Parse(bytes.NewReader([]byte(configYamlV0_1)))
-	suite.Require().NoError(err)
+	c.Assert(err, IsNil)
 }
 
-func checkStructs(tt *testing.T, t reflect.Type, structsChecked map[string]struct{}) {
-	tt.Helper()
-
+func checkStructs(c *C, t reflect.Type, structsChecked map[string]struct{}) {
 	for t.Kind() == reflect.Ptr || t.Kind() == reflect.Map || t.Kind() == reflect.Slice {
 		t = t.Elem()
 	}
@@ -537,23 +447,23 @@ func checkStructs(tt *testing.T, t reflect.Type, structsChecked map[string]struc
 		// Check that the yaml tag does not contain an _.
 		yamlTag := sf.Tag.Get("yaml")
 		if strings.Contains(yamlTag, "_") {
-			tt.Fatalf("yaml field name includes _ character: %s", yamlTag)
+			c.Fatalf("yaml field name includes _ character: %s", yamlTag)
 		}
 		upper := strings.ToUpper(sf.Name)
 		if _, present := byUpperCase[upper]; present {
-			tt.Fatalf("field name collision in configuration object: %s", sf.Name)
+			c.Fatalf("field name collision in configuration object: %s", sf.Name)
 		}
 		byUpperCase[upper] = i
 
-		checkStructs(tt, sf.Type, structsChecked)
+		checkStructs(c, sf.Type, structsChecked)
 	}
 }
 
 // TestValidateConfigStruct makes sure that the config struct has no members
 // with yaml tags that would be ambiguous to the environment variable parser.
-func (suite *ConfigSuite) TestValidateConfigStruct() {
+func (suite *ConfigSuite) TestValidateConfigStruct(c *C) {
 	structsChecked := make(map[string]struct{})
-	checkStructs(suite.T(), reflect.TypeOf(Configuration{}), structsChecked)
+	checkStructs(c, reflect.TypeOf(Configuration{}), structsChecked)
 }
 
 func copyConfig(config Configuration) *Configuration {
@@ -562,7 +472,6 @@ func copyConfig(config Configuration) *Configuration {
 	configCopy.Version = MajorMinorVersion(config.Version.Major(), config.Version.Minor())
 	configCopy.Loglevel = config.Loglevel
 	configCopy.Log = config.Log
-	configCopy.Catalog = config.Catalog
 	configCopy.Log.Fields = make(map[string]interface{}, len(config.Log.Fields))
 	for k, v := range config.Log.Fields {
 		configCopy.Log.Fields[k] = v
@@ -572,8 +481,9 @@ func copyConfig(config Configuration) *Configuration {
 	for k, v := range config.Storage.Parameters() {
 		configCopy.Storage.setParameter(k, v)
 	}
-	for k, v := range config.Storage.TagParameters() {
-		configCopy.Storage.setTagParameter(k, v)
+	configCopy.Reporting = Reporting{
+		Bugsnag:  BugsnagReporting{config.Reporting.Bugsnag.APIKey, config.Reporting.Bugsnag.ReleaseStage, config.Reporting.Bugsnag.Endpoint},
+		NewRelic: NewRelicReporting{config.Reporting.NewRelic.LicenseKey, config.Reporting.NewRelic.Name, config.Reporting.NewRelic.Verbose},
 	}
 
 	configCopy.Auth = Auth{config.Auth.Type(): Parameters{}}
@@ -582,26 +492,14 @@ func copyConfig(config Configuration) *Configuration {
 	}
 
 	configCopy.Notifications = Notifications{Endpoints: []Endpoint{}}
-	configCopy.Notifications.Endpoints = append(configCopy.Notifications.Endpoints, config.Notifications.Endpoints...)
+	for _, v := range config.Notifications.Endpoints {
+		configCopy.Notifications.Endpoints = append(configCopy.Notifications.Endpoints, v)
+	}
 
 	configCopy.HTTP.Headers = make(http.Header)
 	for k, v := range config.HTTP.Headers {
 		configCopy.HTTP.Headers[k] = v
 	}
-	configCopy.HTTP.TLS.ClientCAs = make([]string, 0, len(config.HTTP.TLS.ClientCAs))
-	configCopy.HTTP.TLS.ClientCAs = append(configCopy.HTTP.TLS.ClientCAs, config.HTTP.TLS.ClientCAs...)
-
-	configCopy.Redis = config.Redis
-	configCopy.Redis.TLS.Certificate = config.Redis.TLS.Certificate
-	configCopy.Redis.TLS.Key = config.Redis.TLS.Key
-	configCopy.Redis.TLS.ClientCAs = make([]string, 0, len(config.Redis.TLS.ClientCAs))
-	configCopy.Redis.TLS.ClientCAs = append(configCopy.Redis.TLS.ClientCAs, config.Redis.TLS.ClientCAs...)
-
-	configCopy.Validation = Validation{
-		Enabled:   config.Validation.Enabled,
-		Disabled:  config.Validation.Disabled,
-		Manifests: config.Validation.Manifests,
-	}
 
 	return configCopy
 }

configuration/fuzz_test.go

@@ -1,15 +0,0 @@
-package configuration
-
-import (
-	"bytes"
-	"testing"
-)
-
-// ParserFuzzer implements a fuzzer that targets Parser()
-// nolint:deadcode
-func FuzzConfigurationParse(f *testing.F) {
-	f.Fuzz(func(t *testing.T, data []byte) {
-		rd := bytes.NewReader(data)
-		_, _ = Parse(rd)
-	})
-}

configuration/parser.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/sirupsen/logrus"
+	"github.com/Sirupsen/logrus"
 	"gopkg.in/yaml.v2"
 )
 
@@ -23,7 +23,7 @@ func MajorMinorVersion(major, minor uint) Version {
 }
 
 func (version Version) major() (uint, error) {
-	majorPart, _, _ := strings.Cut(string(version), ".")
+	majorPart := strings.Split(string(version), ".")[0]
 	major, err := strconv.ParseUint(majorPart, 10, 0)
 	return uint(major), err
 }
@@ -35,7 +35,7 @@ func (version Version) Major() uint {
 }
 
 func (version Version) minor() (uint, error) {
-	_, minorPart, _ := strings.Cut(string(version), ".")
+	minorPart := strings.Split(string(version), ".")[1]
 	minor, err := strconv.ParseUint(minorPart, 10, 0)
 	return uint(minor), err
 }
@@ -89,8 +89,8 @@ func NewParser(prefix string, parseInfos []VersionedParseInfo) *Parser {
 	}
 
 	for _, env := range os.Environ() {
-		k, v, _ := strings.Cut(env, "=")
-		p.env = append(p.env, envVar{k, v})
+		envParts := strings.SplitN(env, "=", 2)
+		p.env = append(p.env, envVar{envParts[0], envParts[1]})
 	}
 
 	// We must sort the environment variables lexically by name so that
@@ -122,7 +122,7 @@ func (p *Parser) Parse(in []byte, v interface{}) error {
 
 	parseInfo, ok := p.mapping[versionedStruct.Version]
 	if !ok {
-		return fmt.Errorf("unsupported version: %q", versionedStruct.Version)
+		return fmt.Errorf("Unsupported version: %q", versionedStruct.Version)
 	}
 
 	parseAs := reflect.New(parseInfo.ParseAs)
@@ -138,7 +138,7 @@ func (p *Parser) Parse(in []byte, v interface{}) error {
 
 			err = p.overwriteFields(parseAs, pathStr, path[1:], envVar.value)
 			if err != nil {
-				return fmt.Errorf("parsing environment variable %s: %v", pathStr, err)
+				return err
 			}
 		}
 	}
@@ -166,25 +166,6 @@ func (p *Parser) overwriteFields(v reflect.Value, fullpath string, path []string
 		return p.overwriteStruct(v, fullpath, path, payload)
 	case reflect.Map:
 		return p.overwriteMap(v, fullpath, path, payload)
-	case reflect.Slice:
-		idx, err := strconv.Atoi(path[0])
-		if err != nil {
-			panic("non-numeric index: " + path[0])
-		}
-
-		if idx > v.Len() {
-			panic("undefined index: " + path[0])
-		}
-
-		// if there is no element or the current slice length
-		// is the same as the indexed variable create a new element,
-		// append it and then set it to the passed in env var value.
-		if v.Len() == 0 || idx == v.Len() {
-			typ := v.Type().Elem()
-			elem := reflect.New(typ).Elem()
-			v.Set(reflect.Append(v, elem))
-		}
-		return p.overwriteFields(v.Index(idx), fullpath, path[1:], payload)
 	case reflect.Interface:
 		if v.NumMethod() == 0 {
 			if !v.IsNil() {
@@ -239,7 +220,7 @@ func (p *Parser) overwriteStruct(v reflect.Value, fullpath string, path []string
 		}
 	case reflect.Ptr:
 		if field.IsNil() {
-			field.Set(reflect.New(field.Type().Elem()))
+			field.Set(reflect.New(sf.Type))
 		}
 	}
 

configuration/parser_test.go

@@ -1,95 +0,0 @@
-package configuration
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-type localConfiguration struct {
-	Version       Version `yaml:"version"`
-	Log           *Log    `yaml:"log"`
-	Notifications []Notif `yaml:"notifications,omitempty"`
-}
-
-type Log struct {
-	Formatter string `yaml:"formatter,omitempty"`
-}
-
-type Notif struct {
-	Name string `yaml:"name"`
-}
-
-var expectedConfig = localConfiguration{
-	Version: "0.1",
-	Log: &Log{
-		Formatter: "json",
-	},
-	Notifications: []Notif{
-		{Name: "foo"},
-		{Name: "bar"},
-		{Name: "car"},
-	},
-}
-
-const testConfig = `version: "0.1"
-log:
-  formatter: "text"
-notifications:
-  - name: "foo"
-  - name: "bar"
-  - name: "car"`
-
-func TestParserOverwriteIninitializedPoiner(t *testing.T) {
-	config := localConfiguration{}
-
-	t.Setenv("REGISTRY_LOG_FORMATTER", "json")
-
-	p := NewParser("registry", []VersionedParseInfo{
-		{
-			Version: "0.1",
-			ParseAs: reflect.TypeOf(config),
-			ConversionFunc: func(c interface{}) (interface{}, error) {
-				return c, nil
-			},
-		},
-	})
-
-	err := p.Parse([]byte(testConfig), &config)
-	require.NoError(t, err)
-	require.Equal(t, expectedConfig, config)
-}
-
-const testConfig2 = `version: "0.1"
-log:
-  formatter: "text"
-notifications:
-  - name: "val1"
-  - name: "val2"
-  - name: "car"`
-
-func TestParseOverwriteUnininitializedPoiner(t *testing.T) {
-	config := localConfiguration{}
-
-	t.Setenv("REGISTRY_LOG_FORMATTER", "json")
-
-	// override only first two notificationsvalues
-	// in the tetConfig: leave the last value unchanged.
-	t.Setenv("REGISTRY_NOTIFICATIONS_0_NAME", "foo")
-	t.Setenv("REGISTRY_NOTIFICATIONS_1_NAME", "bar")
-
-	p := NewParser("registry", []VersionedParseInfo{
-		{
-			Version: "0.1",
-			ParseAs: reflect.TypeOf(config),
-			ConversionFunc: func(c interface{}) (interface{}, error) {
-				return c, nil
-			},
-		},
-	})
-
-	err := p.Parse([]byte(testConfig2), &config)
-	require.NoError(t, err)
-	require.Equal(t, expectedConfig, config)
-}

context/context.go

@@ -1,16 +1,21 @@
-package dcontext
+package context
 
 import (
-	"context"
 	"sync"
 
-	"github.com/google/uuid"
+	"github.com/docker/distribution/uuid"
+	"golang.org/x/net/context"
 )
 
+// Context is a copy of Context from the golang.org/x/net/context package.
+type Context interface {
+	context.Context
+}
+
 // instanceContext is a context that provides only an instance id. It is
 // provided as the main background context.
 type instanceContext struct {
-	context.Context
+	Context
 	id   string    // id of context, logged as "instance.id"
 	once sync.Once // once protect generation of the id
 }
@@ -21,8 +26,8 @@ func (ic *instanceContext) Value(key interface{}) interface{} {
 			// We want to lazy initialize the UUID such that we don't
 			// call a random generator from the package initialization
 			// code. For various reasons random could not be available
-			// https://github.com/distribution/distribution/issues/782
-			ic.id = uuid.NewString()
+			// https://github.com/docker/distribution/issues/782
+			ic.id = uuid.Generate().String()
 		})
 		return ic.id
 	}
@@ -37,10 +42,17 @@ var background = &instanceContext{
 // Background returns a non-nil, empty Context. The background context
 // provides a single key, "instance.id" that is globally unique to the
 // process.
-func Background() context.Context {
+func Background() Context {
 	return background
 }
 
+// WithValue returns a copy of parent in which the value associated with key is
+// val. Use context Values only for request-scoped data that transits processes
+// and APIs, not for passing optional parameters to functions.
+func WithValue(parent Context, key, val interface{}) Context {
+	return context.WithValue(parent, key, val)
+}
+
 // stringMapContext is a simple context implementation that checks a map for a
 // key, falling back to a parent if not present.
 type stringMapContext struct {

context/doc.go

@@ -1,71 +1,72 @@
-// Package dcontext provides several utilities for working with
-// Go's context in http requests. Primarily, the focus is on logging relevant
-// request information but this package is not limited to that purpose.
+// Package context provides several utilities for working with
+// golang.org/x/net/context in http requests. Primarily, the focus is on
+// logging relevant request information but this package is not limited to
+// that purpose.
 //
 // The easiest way to get started is to get the background context:
 //
-//	ctx := dcontext.Background()
+// 	ctx := context.Background()
 //
 // The returned context should be passed around your application and be the
 // root of all other context instances. If the application has a version, this
 // line should be called before anything else:
 //
-//	ctx := dcontext.WithVersion(dcontext.Background(), version)
+// 	ctx := context.WithVersion(context.Background(), version)
 //
 // The above will store the version in the context and will be available to
 // the logger.
 //
-// # Logging
+// Logging
 //
 // The most useful aspect of this package is GetLogger. This function takes
 // any context.Context interface and returns the current logger from the
 // context. Canonical usage looks like this:
 //
-//	GetLogger(ctx).Infof("something interesting happened")
+// 	GetLogger(ctx).Infof("something interesting happened")
 //
 // GetLogger also takes optional key arguments. The keys will be looked up in
 // the context and reported with the logger. The following example would
 // return a logger that prints the version with each log message:
 //
-//	ctx := context.WithValue(dcontext.Background(), "version", version)
-//	GetLogger(ctx, "version").Infof("this log message has a version field")
+// 	ctx := context.Context(context.Background(), "version", version)
+// 	GetLogger(ctx, "version").Infof("this log message has a version field")
 //
 // The above would print out a log message like this:
 //
-//	INFO[0000] this log message has a version field        version=v2.0.0-alpha.2.m
+// 	INFO[0000] this log message has a version field        version=v2.0.0-alpha.2.m
 //
 // When used with WithLogger, we gain the ability to decorate the context with
 // loggers that have information from disparate parts of the call stack.
 // Following from the version example, we can build a new context with the
 // configured logger such that we always print the version field:
 //
-//	ctx = WithLogger(ctx, GetLogger(ctx, "version"))
+// 	ctx = WithLogger(ctx, GetLogger(ctx, "version"))
 //
 // Since the logger has been pushed to the context, we can now get the version
 // field for free with our log messages. Future calls to GetLogger on the new
 // context will have the version field:
 //
-//	GetLogger(ctx).Infof("this log message has a version field")
+// 	GetLogger(ctx).Infof("this log message has a version field")
 //
 // This becomes more powerful when we start stacking loggers. Let's say we
 // have the version logger from above but also want a request id. Using the
 // context above, in our request scoped function, we place another logger in
 // the context:
 //
-//	ctx = context.WithValue(ctx, "http.request.id", "unique id") // called when building request context
-//	ctx = WithLogger(ctx, GetLogger(ctx, "http.request.id"))
+// 	ctx = context.WithValue(ctx, "http.request.id", "unique id") // called when building request context
+// 	ctx = WithLogger(ctx, GetLogger(ctx, "http.request.id"))
 //
 // When GetLogger is called on the new context, "http.request.id" will be
 // included as a logger field, along with the original "version" field:
 //
-//	INFO[0000] this log message has a version field        http.request.id=unique id version=v2.0.0-alpha.2.m
+// 	INFO[0000] this log message has a version field        http.request.id=unique id version=v2.0.0-alpha.2.m
 //
 // Note that this only affects the new context, the previous context, with the
 // version field, can be used independently. Put another way, the new logger,
 // added to the request context, is unique to that context and can have
-// request scoped variables.
+// request scoped varaibles.
 //
-// # HTTP Requests
+// HTTP Requests
 //
 // This package also contains several methods for working with http requests.
 // The concepts are very similar to those described above. We simply place the
@@ -73,16 +74,16 @@
 // available. GetRequestLogger can then be called to get request specific
 // variables in a log line:
 //
-//	ctx = WithRequest(ctx, req)
-//	GetRequestLogger(ctx).Infof("request variables")
+// 	ctx = WithRequest(ctx, req)
+// 	GetRequestLogger(ctx).Infof("request variables")
 //
 // Like above, if we want to include the request data in all log messages in
 // the context, we push the logger to a new context and use that one:
 //
-//	ctx = WithLogger(ctx, GetRequestLogger(ctx))
+// 	ctx = WithLogger(ctx, GetRequestLogger(ctx))
 //
 // The concept is fairly powerful and ensures that calls throughout the stack
 // can be traced in log messages. Using the fields like "http.request.id", one
 // can analyze call flow for a particular request with a simple grep of the
 // logs.
-package dcontext
+package context

context/http.go

@@ -1,15 +1,15 @@
-package dcontext
+package context
 
 import (
-	"context"
 	"errors"
+	"net"
 	"net/http"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/distribution/distribution/v3/internal/requestutil"
-	"github.com/google/uuid"
+	log "github.com/Sirupsen/logrus"
+	"github.com/docker/distribution/uuid"
 	"github.com/gorilla/mux"
 )
 
@@ -19,12 +19,56 @@ var (
 	ErrNoResponseWriterContext = errors.New("no http response in context")
 )
 
+func parseIP(ipStr string) net.IP {
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		log.Warnf("invalid remote IP address: %q", ipStr)
+	}
+	return ip
+}
+
+// RemoteAddr extracts the remote address of the request, taking into
+// account proxy headers.
+func RemoteAddr(r *http.Request) string {
+	if prior := r.Header.Get("X-Forwarded-For"); prior != "" {
+		proxies := strings.Split(prior, ",")
+		if len(proxies) > 0 {
+			remoteAddr := strings.Trim(proxies[0], " ")
+			if parseIP(remoteAddr) != nil {
+				return remoteAddr
+			}
+		}
+	}
+	// X-Real-Ip is less supported, but worth checking in the
+	// absence of X-Forwarded-For
+	if realIP := r.Header.Get("X-Real-Ip"); realIP != "" {
+		if parseIP(realIP) != nil {
+			return realIP
+		}
+	}
+
+	return r.RemoteAddr
+}
+
+// RemoteIP extracts the remote IP of the request, taking into
+// account proxy headers.
+func RemoteIP(r *http.Request) string {
+	addr := RemoteAddr(r)
+
+	// Try parsing it as "IP:port"
+	if ip, _, err := net.SplitHostPort(addr); err == nil {
+		return ip
+	}
+
+	return addr
+}
+
 // WithRequest places the request on the context. The context of the request
 // is assigned a unique id, available at "http.request.id". The request itself
 // is available at "http.request". Other common attributes are available under
 // the prefix "http.request.". If a request is already present on the context,
 // this method will panic.
-func WithRequest(ctx context.Context, r *http.Request) context.Context {
+func WithRequest(ctx Context, r *http.Request) Context {
 	if ctx.Value("http.request") != nil {
 		// NOTE(stevvooe): This needs to be considered a programming error. It
 		// is unlikely that we'd want to have more than one request in
@@ -35,31 +79,51 @@ func WithRequest(ctx context.Context, r *http.Request) context.Context {
 	return &httpRequestContext{
 		Context:   ctx,
 		startedAt: time.Now(),
-		id:        uuid.NewString(),
+		id:        uuid.Generate().String(),
 		r:         r,
 	}
 }
 
+// GetRequest returns the http request in the given context. Returns
+// ErrNoRequestContext if the context does not have an http request associated
+// with it.
+func GetRequest(ctx Context) (*http.Request, error) {
+	if r, ok := ctx.Value("http.request").(*http.Request); r != nil && ok {
+		return r, nil
+	}
+	return nil, ErrNoRequestContext
+}
+
 // GetRequestID attempts to resolve the current request id, if possible. An
 // error is return if it is not available on the context.
-func GetRequestID(ctx context.Context) string {
+func GetRequestID(ctx Context) string {
 	return GetStringValue(ctx, "http.request.id")
 }
 
 // WithResponseWriter returns a new context and response writer that makes
 // interesting response statistics available within the context.
-func WithResponseWriter(ctx context.Context, w http.ResponseWriter) (context.Context, http.ResponseWriter) {
+func WithResponseWriter(ctx Context, w http.ResponseWriter) (Context, http.ResponseWriter) {
 	irw := instrumentedResponseWriter{
 		ResponseWriter: w,
 		Context:        ctx,
 	}
+
+	if closeNotifier, ok := w.(http.CloseNotifier); ok {
+		irwCN := &instrumentedResponseWriterCN{
+			instrumentedResponseWriter: irw,
+			CloseNotifier:              closeNotifier,
+		}
+
+		return irwCN, irwCN
+	}
+
 	return &irw, &irw
 }
 
 // GetResponseWriter returns the http.ResponseWriter from the provided
 // context. If not present, ErrNoResponseWriterContext is returned. The
 // returned instance provides instrumentation in the context.
-func GetResponseWriter(ctx context.Context) (http.ResponseWriter, error) {
+func GetResponseWriter(ctx Context) (http.ResponseWriter, error) {
 	v := ctx.Value("http.response")
 
 	rw, ok := v.(http.ResponseWriter)
@@ -79,7 +143,7 @@ var getVarsFromRequest = mux.Vars
 // example, if looking for the variable "name", it can be accessed as
 // "vars.name". Implementations that are accessing values need not know that
 // the underlying context is implemented with gorilla/mux vars.
-func WithVars(ctx context.Context, r *http.Request) context.Context {
+func WithVars(ctx Context, r *http.Request) Context {
 	return &muxVarsContext{
 		Context: ctx,
 		vars:    getVarsFromRequest(r),
@@ -89,7 +153,7 @@ func WithVars(ctx context.Context, r *http.Request) context.Context {
 // GetRequestLogger returns a logger that contains fields from the request in
 // the current context. If the request is not available in the context, no
 // fields will display. Request loggers can safely be pushed onto the context.
-func GetRequestLogger(ctx context.Context) Logger {
+func GetRequestLogger(ctx Context) Logger {
 	return GetLogger(ctx,
 		"http.request.id",
 		"http.request.method",
@@ -105,7 +169,7 @@ func GetRequestLogger(ctx context.Context) Logger {
 // Because the values are read at call time, pushing a logger returned from
 // this function on the context will lead to missing or invalid data. Only
 // call this at the end of a request, after the response has been written.
-func GetResponseLogger(ctx context.Context) Logger {
+func GetResponseLogger(ctx Context) Logger {
 	l := getLogrusLogger(ctx,
 		"http.response.written",
 		"http.response.status",
@@ -122,7 +186,7 @@ func GetResponseLogger(ctx context.Context) Logger {
 
 // httpRequestContext makes information about a request available to context.
 type httpRequestContext struct {
-	context.Context
+	Context
 
 	startedAt time.Time
 	id        string
@@ -134,42 +198,54 @@ type httpRequestContext struct {
 // "request.<component>". For example, r.RequestURI
 func (ctx *httpRequestContext) Value(key interface{}) interface{} {
 	if keyStr, ok := key.(string); ok {
-		switch keyStr {
-		case "http.request":
+		if keyStr == "http.request" {
 			return ctx.r
-		case "http.request.uri":
+		}
+
+		if !strings.HasPrefix(keyStr, "http.request.") {
+			goto fallback
+		}
+
+		parts := strings.Split(keyStr, ".")
+
+		if len(parts) != 3 {
+			goto fallback
+		}
+
+		switch parts[2] {
+		case "uri":
 			return ctx.r.RequestURI
-		case "http.request.remoteaddr":
-			return requestutil.RemoteAddr(ctx.r)
-		case "http.request.method":
+		case "remoteaddr":
+			return RemoteAddr(ctx.r)
+		case "method":
 			return ctx.r.Method
-		case "http.request.host":
+		case "host":
 			return ctx.r.Host
-		case "http.request.referer":
+		case "referer":
 			referer := ctx.r.Referer()
 			if referer != "" {
 				return referer
 			}
-		case "http.request.useragent":
+		case "useragent":
 			return ctx.r.UserAgent()
-		case "http.request.id":
+		case "id":
 			return ctx.id
-		case "http.request.startedat":
+		case "startedat":
 			return ctx.startedAt
-		case "http.request.contenttype":
-			if ct := ctx.r.Header.Get("Content-Type"); ct != "" {
+		case "contenttype":
+			ct := ctx.r.Header.Get("Content-Type")
+			if ct != "" {
 				return ct
 			}
-		default:
-			// no match; fall back to standard behavior below
 		}
 	}
 
+fallback:
 	return ctx.Context.Value(key)
 }
 
 type muxVarsContext struct {
-	context.Context
+	Context
 	vars map[string]string
 }
 
@@ -178,9 +254,12 @@ func (ctx *muxVarsContext) Value(key interface{}) interface{} {
 		if keyStr == "vars" {
 			return ctx.vars
 		}
-		// TODO(thaJeztah): this considers "vars.FOO" and "FOO" to be equal.
-		// We need to check if that's intentional (could be a bug).
-		if v, ok := ctx.vars[strings.TrimPrefix(keyStr, "vars.")]; ok {
+
+		if strings.HasPrefix(keyStr, "vars.") {
+			keyStr = strings.TrimPrefix(keyStr, "vars.")
+		}
+
+		if v, ok := ctx.vars[keyStr]; ok {
 			return v
 		}
 	}
@@ -188,12 +267,20 @@ func (ctx *muxVarsContext) Value(key interface{}) interface{} {
 	return ctx.Context.Value(key)
 }
 
+// instrumentedResponseWriterCN provides response writer information in a
+// context. It implements http.CloseNotifier so that users can detect
+// early disconnects.
+type instrumentedResponseWriterCN struct {
+	instrumentedResponseWriter
+	http.CloseNotifier
+}
+
 // instrumentedResponseWriter provides response writer information in a
 // context. This variant is only used in the case where CloseNotifier is not
 // implemented by the parent ResponseWriter.
 type instrumentedResponseWriter struct {
 	http.ResponseWriter
-	context.Context
+	Context
 
 	mu      sync.Mutex
 	status  int
@@ -232,25 +319,46 @@ func (irw *instrumentedResponseWriter) Flush() {
 
 func (irw *instrumentedResponseWriter) Value(key interface{}) interface{} {
 	if keyStr, ok := key.(string); ok {
-		switch keyStr {
-		case "http.response":
+		if keyStr == "http.response" {
 			return irw
-		case "http.response.written":
-			irw.mu.Lock()
-			defer irw.mu.Unlock()
+		}
+
+		if !strings.HasPrefix(keyStr, "http.response.") {
+			goto fallback
+		}
+
+		parts := strings.Split(keyStr, ".")
+
+		if len(parts) != 3 {
+			goto fallback
+		}
+
+		irw.mu.Lock()
+		defer irw.mu.Unlock()
+
+		switch parts[2] {
+		case "written":
 			return irw.written
-		case "http.response.status":
-			irw.mu.Lock()
-			defer irw.mu.Unlock()
+		case "status":
 			return irw.status
-		case "http.response.contenttype":
-			if ct := irw.Header().Get("Content-Type"); ct != "" {
-				return ct
+		case "contenttype":
+			contentType := irw.Header().Get("Content-Type")
+			if contentType != "" {
+				return contentType
 			}
-		default:
-			// no match; fall back to standard behavior below
 		}
 	}
 
+fallback:
 	return irw.Context.Value(key)
 }
+
+func (irw *instrumentedResponseWriterCN) Value(key interface{}) interface{} {
+	if keyStr, ok := key.(string); ok {
+		if keyStr == "http.response" {
+			return irw
+		}
+	}
+
+	return irw.instrumentedResponseWriter.Value(key)
+}

context/http_test.go

@@ -1,7 +1,10 @@
-package dcontext
+package context
 
 import (
 	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
 	"reflect"
 	"testing"
 	"time"
@@ -11,7 +14,7 @@ func TestWithRequest(t *testing.T) {
 	var req http.Request
 
 	start := time.Now()
-	req.Method = http.MethodGet
+	req.Method = "GET"
 	req.Host = "example.com"
 	req.RequestURI = "/test-test"
 	req.Header = make(http.Header)
@@ -19,7 +22,7 @@ func TestWithRequest(t *testing.T) {
 	req.Header.Set("User-Agent", "test/0.1")
 
 	ctx := WithRequest(Background(), &req)
-	for _, tc := range []struct {
+	for _, testcase := range []struct {
 		key      string
 		expected interface{}
 	}{
@@ -58,18 +61,18 @@ func TestWithRequest(t *testing.T) {
 			key: "http.request.startedat",
 		},
 	} {
-		v := ctx.Value(tc.key)
+		v := ctx.Value(testcase.key)
 
 		if v == nil {
-			t.Fatalf("value not found for %q", tc.key)
+			t.Fatalf("value not found for %q", testcase.key)
 		}
 
-		if tc.expected != nil && v != tc.expected {
-			t.Fatalf("%s: %v != %v", tc.key, v, tc.expected)
+		if testcase.expected != nil && v != testcase.expected {
+			t.Fatalf("%s: %v != %v", testcase.key, v, testcase.expected)
 		}
 
 		// Key specific checks!
-		switch tc.key {
+		switch testcase.key {
 		case "http.request.id":
 			if _, ok := v.(string); !ok {
 				t.Fatalf("request id not a string: %v", v)
@@ -192,7 +195,7 @@ func TestWithVars(t *testing.T) {
 	}
 
 	ctx := WithVars(Background(), &req)
-	for _, tc := range []struct {
+	for _, testcase := range []struct {
 		key      string
 		expected interface{}
 	}{
@@ -209,10 +212,74 @@ func TestWithVars(t *testing.T) {
 			expected: "qwer",
 		},
 	} {
-		v := ctx.Value(tc.key)
+		v := ctx.Value(testcase.key)
 
-		if !reflect.DeepEqual(v, tc.expected) {
-			t.Fatalf("%q: %v != %v", tc.key, v, tc.expected)
+		if !reflect.DeepEqual(v, testcase.expected) {
+			t.Fatalf("%q: %v != %v", testcase.key, v, testcase.expected)
 		}
 	}
 }
+
+// SingleHostReverseProxy will insert an X-Forwarded-For header, and can be used to test
+// RemoteAddr().  A fake RemoteAddr cannot be set on the HTTP request - it is overwritten
+// at the transport layer to 127.0.0.1:<port> .  However, as the X-Forwarded-For header
+// just contains the IP address, it is different enough for testing.
+func TestRemoteAddr(t *testing.T) {
+	var expectedRemote string
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer r.Body.Close()
+
+		if r.RemoteAddr == expectedRemote {
+			t.Errorf("Unexpected matching remote addresses")
+		}
+
+		actualRemote := RemoteAddr(r)
+		if expectedRemote != actualRemote {
+			t.Errorf("Mismatching remote hosts: %v != %v", expectedRemote, actualRemote)
+		}
+
+		w.WriteHeader(200)
+	}))
+
+	defer backend.Close()
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	proxy := httputil.NewSingleHostReverseProxy(backendURL)
+	frontend := httptest.NewServer(proxy)
+	defer frontend.Close()
+
+	// X-Forwarded-For set by proxy
+	expectedRemote = "127.0.0.1"
+	proxyReq, err := http.NewRequest("GET", frontend.URL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = http.DefaultClient.Do(proxyReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// RemoteAddr in X-Real-Ip
+	getReq, err := http.NewRequest("GET", backend.URL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedRemote = "1.2.3.4"
+	getReq.Header["X-Real-ip"] = []string{expectedRemote}
+	_, err = http.DefaultClient.Do(getReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Valid X-Real-Ip and invalid X-Forwarded-For
+	getReq.Header["X-forwarded-for"] = []string{"1.2.3"}
+	_, err = http.DefaultClient.Do(getReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+}

context/logger.go

@@ -1,17 +1,10 @@
-package dcontext
+package context
 
 import (
-	"context"
 	"fmt"
+
+	"github.com/Sirupsen/logrus"
 	"runtime"
-	"sync"
-
-	"github.com/sirupsen/logrus"
-)
-
-var (
-	defaultLogger   *logrus.Entry = logrus.StandardLogger().WithField("go.version", runtime.Version())
-	defaultLoggerMu sync.RWMutex
 )
 
 // Logger provides a leveled-logging interface.
@@ -45,28 +38,24 @@ type Logger interface {
 	Warn(args ...interface{})
 	Warnf(format string, args ...interface{})
 	Warnln(args ...interface{})
-
-	WithError(err error) *logrus.Entry
 }
 
-type loggerKey struct{}
-
 // WithLogger creates a new context with provided logger.
-func WithLogger(ctx context.Context, logger Logger) context.Context {
-	return context.WithValue(ctx, loggerKey{}, logger)
+func WithLogger(ctx Context, logger Logger) Context {
+	return WithValue(ctx, "logger", logger)
 }
 
 // GetLoggerWithField returns a logger instance with the specified field key
 // and value without affecting the context. Extra specified keys will be
 // resolved from the context.
-func GetLoggerWithField(ctx context.Context, key, value interface{}, keys ...interface{}) Logger {
+func GetLoggerWithField(ctx Context, key, value interface{}, keys ...interface{}) Logger {
 	return getLogrusLogger(ctx, keys...).WithField(fmt.Sprint(key), value)
 }
 
 // GetLoggerWithFields returns a logger instance with the specified fields
 // without affecting the context. Extra specified keys will be resolved from
 // the context.
-func GetLoggerWithFields(ctx context.Context, fields map[interface{}]interface{}, keys ...interface{}) Logger {
+func GetLoggerWithFields(ctx Context, fields map[interface{}]interface{}, keys ...interface{}) Logger {
 	// must convert from interface{} -> interface{} to string -> interface{} for logrus.
 	lfields := make(logrus.Fields, len(fields))
 	for key, value := range fields {
@@ -82,31 +71,19 @@ func GetLoggerWithFields(ctx context.Context, fields map[interface{}]interface{}
 // argument passed to GetLogger will be passed to fmt.Sprint when expanded as
 // a logging key field. If context keys are integer constants, for example,
 // its recommended that a String method is implemented.
-func GetLogger(ctx context.Context, keys ...interface{}) Logger {
+func GetLogger(ctx Context, keys ...interface{}) Logger {
 	return getLogrusLogger(ctx, keys...)
 }
 
-// SetDefaultLogger sets the default logger upon which to base new loggers.
-func SetDefaultLogger(logger Logger) {
-	entry, ok := logger.(*logrus.Entry)
-	if !ok {
-		return
-	}
-
-	defaultLoggerMu.Lock()
-	defaultLogger = entry
-	defaultLoggerMu.Unlock()
-}
-
 // GetLogrusLogger returns the logrus logger for the context. If one more keys
 // are provided, they will be resolved on the context and included in the
 // logger. Only use this function if specific logrus functionality is
 // required.
-func getLogrusLogger(ctx context.Context, keys ...interface{}) *logrus.Entry {
+func getLogrusLogger(ctx Context, keys ...interface{}) *logrus.Entry {
 	var logger *logrus.Entry
 
 	// Get a logger, if it is present.
-	loggerInterface := ctx.Value(loggerKey{})
+	loggerInterface := ctx.Value("logger")
 	if loggerInterface != nil {
 		if lgr, ok := loggerInterface.(*logrus.Entry); ok {
 			logger = lgr
@@ -122,9 +99,9 @@ func getLogrusLogger(ctx context.Context, keys ...interface{}) *logrus.Entry {
 			fields["instance.id"] = instanceID
 		}
 
-		defaultLoggerMu.RLock()
-		logger = defaultLogger.WithFields(fields)
-		defaultLoggerMu.RUnlock()
+		fields["go.version"] = runtime.Version()
+		// If no logger is found, just return the standard logger.
+		logger = logrus.StandardLogger().WithFields(fields)
 	}
 
 	fields := logrus.Fields{}

context/trace.go

@@ -1,11 +1,10 @@
-package dcontext
+package context
 
 import (
-	"context"
 	"runtime"
 	"time"
 
-	"github.com/google/uuid"
+	"github.com/docker/distribution/uuid"
 )
 
 // WithTrace allocates a traced timing span in a new context. This allows a
@@ -24,20 +23,20 @@ import (
 //
 // Here is an example of the usage:
 //
-//	func timedOperation(ctx Context) {
-//		ctx, done := WithTrace(ctx)
-//		defer done("this will be the log message")
-//		// ... function body ...
-//	}
+// 	func timedOperation(ctx Context) {
+// 		ctx, done := WithTrace(ctx)
+// 		defer done("this will be the log message")
+// 		// ... function body ...
+// 	}
 //
 // If the function ran for roughly 1s, such a usage would emit a log message
 // as follows:
 //
-//	INFO[0001] this will be the log message  trace.duration=1.004575763s trace.func=github.com/distribution/distribution/context.traceOperation trace.id=<id> ...
+// 	INFO[0001] this will be the log message  trace.duration=1.004575763s trace.func=github.com/docker/distribution/context.traceOperation trace.id=<id> ...
 //
 // Notice that the function name is automatically resolved, along with the
 // package and a trace id is emitted that can be linked with parent ids.
-func WithTrace(ctx context.Context) (context.Context, func(format string, a ...interface{})) {
+func WithTrace(ctx Context) (Context, func(format string, a ...interface{})) {
 	if ctx == nil {
 		ctx = Background()
 	}
@@ -46,7 +45,7 @@ func WithTrace(ctx context.Context) (context.Context, func(format string, a ...i
 	f := runtime.FuncForPC(pc)
 	ctx = &traced{
 		Context: ctx,
-		id:      uuid.NewString(),
+		id:      uuid.Generate().String(),
 		start:   time.Now(),
 		parent:  GetStringValue(ctx, "trace.id"),
 		fnname:  f.Name(),
@@ -70,7 +69,7 @@ func WithTrace(ctx context.Context) (context.Context, func(format string, a ...i
 // also provides fast lookup for the various attributes that are available on
 // the trace.
 type traced struct {
-	context.Context
+	Context
 	id     string
 	parent string
 	start  time.Time

context/trace_test.go

@@ -1,4 +1,4 @@
-package dcontext
+package context
 
 import (
 	"runtime"
@@ -8,7 +8,6 @@ import (
 
 // TestWithTrace ensures that tracing has the expected values in the context.
 func TestWithTrace(t *testing.T) {
-	t.Parallel()
 	pc, file, _, _ := runtime.Caller(0) // get current caller.
 	f := runtime.FuncForPC(pc)
 
@@ -34,31 +33,14 @@ func TestWithTrace(t *testing.T) {
 	}
 
 	ctx, done := WithTrace(Background())
-	t.Cleanup(func() { done("this will be emitted at end of test") })
+	defer done("this will be emitted at end of test")
 
-	tests := append(base, valueTestCase{
+	checkContextForValues(t, ctx, append(base, valueTestCase{
 		key:      "trace.func",
 		expected: f.Name(),
-	})
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.key, func(t *testing.T) {
-			t.Parallel()
-			v := ctx.Value(tc.key)
-			if tc.notnilorempty {
-				if v == nil || v == "" {
-					t.Fatalf("value was nil or empty: %#v", v)
-				}
-				return
-			}
+	}))
 
-			if v != tc.expected {
-				t.Fatalf("unexpected value: %v != %v", v, tc.expected)
-			}
-		})
-	}
-
-	tracedFn := func() {
+	traced := func() {
 		parentID := ctx.Value("trace.id") // ensure the parent trace id is correct.
 
 		pc, _, _, _ := runtime.Caller(0) // get current caller.
@@ -66,32 +48,15 @@ func TestWithTrace(t *testing.T) {
 		ctx, done := WithTrace(ctx)
 		defer done("this should be subordinate to the other trace")
 		time.Sleep(time.Second)
-		tests := append(base, valueTestCase{
+		checkContextForValues(t, ctx, append(base, valueTestCase{
 			key:      "trace.func",
 			expected: f.Name(),
 		}, valueTestCase{
 			key:      "trace.parent.id",
 			expected: parentID,
-		})
-		for _, tc := range tests {
-			tc := tc
-			t.Run(tc.key, func(t *testing.T) {
-				t.Parallel()
-				v := ctx.Value(tc.key)
-				if tc.notnilorempty {
-					if v == nil || v == "" {
-						t.Fatalf("value was nil or empty: %#v", v)
-					}
-					return
-				}
-
-				if v != tc.expected {
-					t.Fatalf("unexpected value: %v != %v", v, tc.expected)
-				}
-			})
-		}
+		}))
 	}
-	tracedFn()
+	traced()
 
 	time.Sleep(time.Second)
 }
@@ -101,3 +66,20 @@ type valueTestCase struct {
 	expected      interface{}
 	notnilorempty bool // just check not empty/not nil
 }
+
+func checkContextForValues(t *testing.T, ctx Context, values []valueTestCase) {
+
+	for _, testcase := range values {
+		v := ctx.Value(testcase.key)
+		if testcase.notnilorempty {
+			if v == nil || v == "" {
+				t.Fatalf("value was nil or empty for %q: %#v", testcase.key, v)
+			}
+			continue
+		}
+
+		if v != testcase.expected {
+			t.Fatalf("unexpected value for key %q: %v != %v", testcase.key, v, testcase.expected)
+		}
+	}
+}

context/util.go

@@ -1,14 +1,13 @@
-package dcontext
+package context
 
 import (
-	"context"
 	"time"
 )
 
 // Since looks up key, which should be a time.Time, and returns the duration
 // since that time. If the key is not found, the value returned will be zero.
 // This is helpful when inferring metrics related to context execution times.
-func Since(ctx context.Context, key interface{}) time.Duration {
+func Since(ctx Context, key interface{}) time.Duration {
 	if startedAt, ok := ctx.Value(key).(time.Time); ok {
 		return time.Since(startedAt)
 	}
@@ -17,7 +16,7 @@ func Since(ctx context.Context, key interface{}) time.Duration {
 
 // GetStringValue returns a string value from the context. The empty string
 // will be returned if not found.
-func GetStringValue(ctx context.Context, key interface{}) (value string) {
+func GetStringValue(ctx Context, key interface{}) (value string) {
 	if valuev, ok := ctx.Value(key).(string); ok {
 		value = valuev
 	}

context/version.go

@@ -0,0 +1,16 @@
+package context
+
+// WithVersion stores the application version in the context. The new context
+// gets a logger to ensure log messages are marked with the application
+// version.
+func WithVersion(ctx Context, version string) Context {
+	ctx = WithValue(ctx, "version", version)
+	// push a new logger onto the stack
+	return WithLogger(ctx, GetLogger(ctx, "version"))
+}
+
+// GetVersion returns the application version from the context. An empty
+// string may returned if the version was not set on the context.
+func GetVersion(ctx Context) string {
+	return GetStringValue(ctx, "version")
+}

context/version_test.go

@@ -1,4 +1,4 @@
-package dcontext
+package context
 
 import "testing"
 

contrib/apache/README.MD

@@ -0,0 +1,36 @@
+# Apache HTTPd sample for Registry v1, v2 and mirror
+
+3 containers involved 
+
+* Docker Registry v1 (registry 0.9.1)
+* Docker Registry v2 (registry 2.0.0)
+* Docker Registry v1 in mirror mode
+
+HTTP for mirror and HTTPS for v1 & v2
+
+* http://registry.example.com proxify Docker Registry 1.0 in Mirror mode
+* https://registry.example.com proxify Docker Registry 1.0 or 2.0 in Hosting mode
+
+## 3 Docker containers should be started 
+
+* Docker Registry 1.0 in Mirror mode : port 5001
+* Docker Registry 1.0 in Hosting mode : port 5000
+* Docker Registry 2.0 in Hosting mode : port 5002
+
+### Registry v1
+
+    docker run -d -e SETTINGS_FLAVOR=dev -v /var/lib/docker-registry/storage/hosting-v1:/tmp -p 5000:5000 registry:0.9.1"
+
+### Mirror
+
+    docker run -d -e SETTINGS_FLAVOR=dev -e STANDALONE=false -e MIRROR_SOURCE=https://registry-1.docker.io -e MIRROR_SOURCE_INDEX=https://index.docker.io \
+                  -e MIRROR_TAGS_CACHE_TTL=172800 -v /var/lib/docker-registry/storage/mirror:/tmp -p 5001:5000 registry:0.9.1"
+
+### Registry v2
+
+    docker run -d -e SETTINGS_FLAVOR=dev -v /var/lib/axway/docker-registry/storage/hosting2-v2:/tmp -p 5002:5000 registry:2"
+
+# For Hosting mode access
+
+* users should have account (valid-user) to be able to fetch images
+* only users using account docker-deployer will be allowed to push images

contrib/apache/apache.conf

@@ -0,0 +1,127 @@
+#
+# Sample Apache 2.x configuration where : 
+#
+
+<VirtualHost *:80>
+         
+  ServerName registry.example.com
+  ServerAlias www.registry.example.com
+
+  ProxyRequests     off
+  ProxyPreserveHost on
+
+  # no proxy for /error/ (Apache HTTPd errors messages)
+  ProxyPass /error/ !
+
+  ProxyPass        /_ping http://localhost:5001/_ping
+  ProxyPassReverse /_ping http://localhost:5001/_ping
+
+  ProxyPass        /v1 http://localhost:5001/v1
+  ProxyPassReverse /v1 http://localhost:5001/v1
+
+  # Logs
+  ErrorLog ${APACHE_LOG_DIR}/mirror_error_log
+  CustomLog ${APACHE_LOG_DIR}/mirror_access_log combined env=!dontlog
+
+</VirtualHost>
+
+
+<VirtualHost *:443>
+
+  ServerName registry.example.com
+  ServerAlias www.registry.example.com
+
+  SSLEngine on
+  SSLCertificateFile /etc/apache2/ssl/registry.example.com.crt
+  SSLCertificateKeyFile /etc/apache2/ssl/registry.example.com.key
+
+  # Higher Strength SSL Ciphers
+  SSLProtocol all -SSLv2 -SSLv3 -TLSv1 
+  SSLCipherSuite RC4-SHA:HIGH
+  SSLHonorCipherOrder on
+
+  # Logs
+  ErrorLog ${APACHE_LOG_DIR}/registry_error_ssl_log
+  CustomLog ${APACHE_LOG_DIR}/registry_access_ssl_log combined env=!dontlog
+
+  Header always set "Docker-Distribution-Api-Version" "registry/2.0"
+  Header onsuccess set "Docker-Distribution-Api-Version" "registry/2.0"
+  RequestHeader set X-Forwarded-Proto "https"
+
+  ProxyRequests     off
+  ProxyPreserveHost on
+
+  # no proxy for /error/ (Apache HTTPd errors messages)
+  ProxyPass /error/ !
+
+  #
+  # Registry v1
+  #
+
+  ProxyPass        /v1 http://localhost:5000/v1
+  ProxyPassReverse /v1 http://localhost:5000/v1
+
+  ProxyPass        /_ping http://localhost:5000/_ping
+  ProxyPassReverse /_ping http://localhost:5000/_ping
+
+  # Authentication require for push
+  <Location /v1>
+    Order deny,allow
+    Allow from all
+    AuthName "Registry Authentication"
+    AuthType basic
+    AuthUserFile "/etc/apache2/htpasswd/registry-htpasswd"
+
+    # Read access to authentified users
+    <Limit GET HEAD>
+      Require valid-user
+    </Limit>
+
+    # Write access to docker-deployer account only
+    <Limit POST PUT DELETE>
+      Require user docker-deployer
+    </Limit>
+
+  </Location>
+
+  # Allow ping to run unauthenticated.
+  <Location /v1/_ping>
+    Satisfy any
+    Allow from all
+  </Location>
+
+  # Allow ping to run unauthenticated.
+  <Location /_ping>
+    Satisfy any
+    Allow from all
+  </Location>
+
+  #
+  # Registry v2
+  #
+
+  ProxyPass        /v2 http://localhost:5002/v2
+  ProxyPassReverse /v2 http://localhost:5002/v2
+
+  <Location /v2>
+    Order deny,allow
+    Allow from all
+    AuthName "Registry Authentication"
+    AuthType basic
+    AuthUserFile "/etc/apache2/htpasswd/registry-htpasswd"
+
+    # Read access to authentified users
+    <Limit GET HEAD>
+      Require valid-user
+    </Limit>
+
+    # Write access to docker-deployer only
+    <Limit POST PUT DELETE>
+      Require user docker-deployer
+    </Limit>
+
+  </Location>
+
+
+</VirtualHost>
+

contrib/compose/README.md

@@ -0,0 +1,147 @@
+# Docker Compose V1 + V2 registry
+
+This compose configuration configures a `v1` and `v2` registry behind an `nginx`
+proxy. By default, you can access the combined registry at `localhost:5000`.
+
+The configuration does not support pushing images to `v2` and pulling from `v1`.
+If a `docker` client has a version less than 1.6, Nginx will route its requests
+to the 1.0 registry. Requests from newer clients will route to the 2.0 registry.
+
+### Install Docker Compose
+
+1. Open a new terminal on the host with your `distribution` source.
+
+2. Get the `docker-compose` binary.
+
+		$ sudo wget https://github.com/docker/compose/releases/download/1.1.0/docker-compose-`uname  -s`-`uname -m` -O /usr/local/bin/docker-compose
+
+	This command installs the binary in the `/usr/local/bin` directory. 
+	
+3. Add executable permissions to the binary.
+
+		$  sudo chmod +x /usr/local/bin/docker-compose
+		
+## Build and run with Compose
+	
+1. In your terminal, navigate to the `distribution/contrib/compose` directory
+
+	This directory includes a single `docker-compose.yml` configuration.
+	
+		nginx:
+			build: "nginx"
+			ports:
+				- "5000:5000"
+			links:
+				- registryv1:registryv1
+				- registryv2:registryv2
+		registryv1:
+			image: registry
+			ports:
+				- "5000"
+		registryv2:
+			build: "../../"
+			ports:
+				- "5000"
+
+	This configuration builds a new `nginx` image as specified by the
+	`nginx/Dockerfile` file. The 1.0 registry comes from Docker's official
+	public image. Finally, the registry 2.0 image is built from the
+	`distribution/Dockerfile` you've used previously.
+ 		
+2. Get a registry 1.0 image.
+
+		$ docker pull registry:0.9.1 
+
+	The Compose configuration looks for this image locally. If you don't do this
+	step, later steps can fail.
+	
+3. Build `nginx`, the registry 2.0 image, and 
+
+		$ docker-compose build
+		registryv1 uses an image, skipping
+		Building registryv2...
+		Step 0 : FROM golang:1.4
+		
+		...
+		
+		Removing intermediate container 9f5f5068c3f3
+		Step 4 : COPY docker-registry-v2.conf /etc/nginx/docker-registry-v2.conf
+		 ---> 74acc70fa106
+		Removing intermediate container edb84c2b40cb
+		Successfully built 74acc70fa106
+		
+	The commmand outputs its progress until it completes.
+
+4. Start your configuration with compose.
+
+		$ docker-compose up
+		Recreating compose_registryv1_1...
+		Recreating compose_registryv2_1...
+		Recreating compose_nginx_1...
+		Attaching to compose_registryv1_1, compose_registryv2_1, compose_nginx_1
+		...
+	
+
+5. In another terminal, display the running configuration.
+
+		$ docker ps
+		CONTAINER ID        IMAGE                       COMMAND                CREATED             STATUS              PORTS                                     NAMES
+		a81ad2557702        compose_nginx:latest        "nginx -g 'daemon of   8 minutes ago       Up 8 minutes        80/tcp, 443/tcp, 0.0.0.0:5000->5000/tcp   compose_nginx_1        
+		0618437450dd        compose_registryv2:latest   "registry cmd/regist   8 minutes ago       Up 8 minutes        0.0.0.0:32777->5000/tcp                   compose_registryv2_1   
+		aa82b1ed8e61        registry:latest             "docker-registry"      8 minutes ago       Up 8 minutes        0.0.0.0:32776->5000/tcp                   compose_registryv1_1   
+	
+### Explore a bit
+
+1. Check for TLS on your `nginx` server.
+
+		$ curl -v https://localhost:5000
+		* Rebuilt URL to: https://localhost:5000/
+		* Hostname was NOT found in DNS cache
+		*   Trying 127.0.0.1...
+		* Connected to localhost (127.0.0.1) port 5000 (#0)
+		* successfully set certificate verify locations:
+		*   CAfile: none
+			CApath: /etc/ssl/certs
+		* SSLv3, TLS handshake, Client hello (1):
+		* SSLv3, TLS handshake, Server hello (2):
+		* SSLv3, TLS handshake, CERT (11):
+		* SSLv3, TLS alert, Server hello (2):
+		* SSL certificate problem: self signed certificate
+		* Closing connection 0
+		curl: (60) SSL certificate problem: self signed certificate
+		More details here: http://curl.haxx.se/docs/sslcerts.html
+		
+2. Tag the `v1` registry image.
+
+		 $ docker tag registry:latest localhost:5000/registry_one:latest
+
+2. Push it to the localhost.
+
+		 $ docker push localhost:5000/registry_one:latest
+		
+	If you are using the 1.6 Docker client, this pushes the image the `v2 `registry.
+
+4. Use `curl` to list the image in the registry.
+
+			$ curl -v -X GET http://localhost:32777/v2/registry1/tags/list
+			* Hostname was NOT found in DNS cache
+			*   Trying 127.0.0.1...
+			* Connected to localhost (127.0.0.1) port 32777 (#0)
+			> GET /v2/registry1/tags/list HTTP/1.1
+			> User-Agent: curl/7.36.0
+			> Host: localhost:32777
+			> Accept: */*
+			> 
+			< HTTP/1.1 200 OK
+			< Content-Type: application/json; charset=utf-8
+			< Docker-Distribution-Api-Version: registry/2.0
+			< Date: Tue, 14 Apr 2015 22:34:13 GMT
+			< Content-Length: 39
+			< 
+			{"name":"registry1","tags":["latest"]}
+			* Connection #0 to host localhost left intact
+		
+	This example refers to the specific port assigned to the 2.0 registry. You saw
+	this port earlier, when you used `docker ps` to show your running containers.
+
+

contrib/compose/docker-compose.yml

@@ -0,0 +1,15 @@
+nginx:
+  build: "nginx"
+  ports:
+    - "5000:5000"
+  links:
+    - registryv1:registryv1
+    - registryv2:registryv2
+registryv1:
+  image: registry
+  ports:
+    - "5000"
+registryv2:
+  build: "../../"
+  ports:
+    - "5000"

contrib/compose/nginx/Dockerfile

@@ -0,0 +1,6 @@
+FROM nginx:1.7
+
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY registry.conf /etc/nginx/conf.d/registry.conf
+COPY docker-registry.conf /etc/nginx/docker-registry.conf
+COPY docker-registry-v2.conf /etc/nginx/docker-registry-v2.conf

contrib/compose/nginx/docker-registry-v2.conf

@@ -0,0 +1,6 @@
+proxy_pass                          http://docker-registry-v2;
+proxy_set_header  Host              $http_host;   # required for docker client's sake
+proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
+proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header  X-Forwarded-Proto $scheme;
+proxy_read_timeout                  900;

contrib/compose/nginx/docker-registry.conf

@@ -0,0 +1,7 @@
+proxy_pass                          http://docker-registry;
+proxy_set_header  Host              $http_host;   # required for docker client's sake
+proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
+proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header  X-Forwarded-Proto $scheme;
+proxy_set_header  Authorization     ""; # For basic auth through nginx in v1 to work, please comment this line
+proxy_read_timeout                  900;

contrib/compose/nginx/nginx.conf

@@ -0,0 +1,27 @@
+user  nginx;
+worker_processes  1;
+
+error_log /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log main;
+
+    sendfile        on;
+
+    keepalive_timeout  65;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+

contrib/compose/nginx/registry.conf

@@ -0,0 +1,41 @@
+# Docker registry proxy for api versions 1 and 2
+
+upstream docker-registry {
+  server registryv1:5000;
+}
+
+upstream docker-registry-v2 {
+  server registryv2:5000;
+}
+
+# No client auth or TLS
+server {
+  listen 5000;
+  server_name localhost;
+
+  # disable any limits to avoid HTTP 413 for large image uploads
+  client_max_body_size 0;
+
+  # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+  chunked_transfer_encoding on;
+
+  location /v2/ {
+    # Do not allow connections from docker 1.5 and earlier
+    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
+    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
+      return 404;
+    }
+
+    # To add basic authentication to v2 use auth_basic setting plus add_header
+    # auth_basic "registry.localhost";
+    # auth_basic_user_file test.password;
+    # add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
+
+    include               docker-registry-v2.conf;
+  }
+
+  location / {
+    include               docker-registry.conf;
+  }
+}
+

contrib/docker-integration/Dockerfile

@@ -0,0 +1,46 @@
+FROM debian:jessie
+
+MAINTAINER Docker Distribution Team <distribution@docker.com>
+
+# compile and runtime deps
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        # For DIND
+        ca-certificates \
+        curl \
+        iptables \
+        procps \
+        e2fsprogs \
+        xz-utils \
+        # For build
+        build-essential \
+        file \
+        git \
+        net-tools \ 
+    && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Install Docker
+ENV VERSION 1.7.1
+RUN curl -L -o /usr/local/bin/docker https://test.docker.com/builds/Linux/x86_64/docker-${VERSION} \
+    && chmod +x /usr/local/bin/docker
+
+# Install DIND
+RUN curl -L -o /dind https://raw.githubusercontent.com/docker/docker/v1.8.1/hack/dind \
+    && chmod +x /dind
+
+# Install bats
+RUN cd /usr/local/src/ \
+    && git clone https://github.com/sstephenson/bats.git \
+    && cd bats \
+    && ./install.sh /usr/local
+
+# Install docker-compose
+RUN curl -L https://github.com/docker/compose/releases/download/1.3.3/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose \
+    && chmod +x /usr/local/bin/docker-compose
+
+RUN mkdir -p /go/src/github.com/docker/distribution
+WORKDIR /go/src/github.com/docker/distribution/contrib/docker-integration
+
+VOLUME /var/lib/docker
+
+ENTRYPOINT ["/dind"]

contrib/docker-integration/README.md

@@ -0,0 +1,138 @@
+# Docker Registry Integration Testing
+
+These integration tests cover interactions between the Docker daemon and the
+registry server. All tests are run using the docker cli.
+
+The compose configuration is intended to setup a testing environment for Docker
+using multiple registry configurations. These configurations include different
+combinations of a v1 and v2 registry as well as TLS configurations.
+
+## Running inside of Docker
+### Get integration container
+The container image to run the integation tests will need to be pulled or built
+locally.
+
+*Building locally*
+```
+$ docker build -t distribution/docker-integration .
+```
+
+### Run script
+
+Invoke the tests within Docker through the `run.sh` script.
+
+```
+$ ./run.sh
+```
+
+Run with aufs driver and tmp volume
+**NOTE: Using a volume will prevent multiple runs from needing to
+re-pull images**
+```
+$ DOCKER_GRAPHDRIVER=aufs DOCKER_VOLUME=/tmp/volume ./run.sh
+```
+
+### Example developer flow 
+
+These tests are useful for developing both as a registry and docker
+core developer. The following setup may be used to do integration
+testing between development versions
+
+Insert into your `.zshrc` or `.bashrc`
+
+```
+# /usr/lib/docker for Docker-in-Docker
+# Set this directory to make each invocation run much faster, without
+# the need to repull images.
+export DOCKER_VOLUME=$HOME/.docker-test-volume
+
+# Use overlay for all Docker testing, try aufs if overlay not supported
+export DOCKER_GRAPHDRIVER=overlay
+
+# Name this according to personal preference
+function rdtest() {
+  if [ "$1" != "" ]; then
+    DOCKER_BINARY=$GOPATH/src/github.com/docker/docker/bundles/$1/binary/docker
+    if [ ! -f $DOCKER_BINARY ]; then
+      current_version=`cat $GOPATH/src/github.com/docker/docker/VERSION`
+      echo "$DOCKER_BINARY does not exist"
+      echo "Current checked out docker version: $current_version"
+      echo "Checkout desired version and run 'make binary' from $GOPATH/src/github.com/docker/docker"
+      return 1
+    fi
+  fi
+
+  $GOPATH/src/github.com/docker/distribution/contrib/docker-integration/run.sh
+}
+```
+
+Run with Docker release version
+```
+$ rdtest
+```
+
+Run using local development version of docker
+```
+$ cd $GOPATH/src/github.com/docker/docker
+$ make binary
+$ rdtest `cat VERSION`
+```
+
+## Running manually outside of Docker
+
+### Install Docker Compose
+
+[Docker Compose Installation Guide](https://docs.docker.com/compose/install/)
+
+### Start compose setup
+```
+docker-compose up
+```
+
+### Install Certificates
+The certificates must be installed in /etc/docker/cert.d in order to use TLS
+client auth and use the CA certificate.
+```
+sudo sh ./install_certs.sh
+```
+
+### Test with Docker
+Tag an image as with any other private registry. Attempt to push the image.
+
+```
+docker pull hello-world
+docker tag hello-world localhost:5440/hello-world
+docker push localhost:5440/hello-world
+
+docker tag hello-world localhost:5441/hello-world
+docker push localhost:5441/hello-world
+# Perform login using user `testuser` and password `passpassword`
+```
+
+### Set /etc/hosts entry
+Find the non-localhost ip address of local machine
+
+### Run bats
+Run the bats tests after updating /etc/hosts, installing the certificates, and
+running the `docker-compose` script.
+```
+bats -p .
+```
+
+## Configurations
+
+Port | V2 | V1 | TLS | Authentication
+--- | --- | --- | --- | ---
+5000 | yes | yes | no | none
+5001 | no | yes | no | none
+5002 | yes | no | no | none
+5011 | no | yes | yes | none
+5440 | yes | yes | yes | none
+5441 | yes | yes | yes | basic (testuser/passpassword)
+5442 | yes | yes | yes | TLS client
+5443 | yes | yes | yes | TLS client (no CA)
+5444 | yes | yes | yes | TLS client + basic (testuser/passpassword)
+5445 | yes | yes | yes (no CA) | none
+5446 | yes | yes | yes (no CA) | basic (testuser/passpassword)
+5447 | yes | yes | yes (no CA) | TLS client
+5448 | yes | yes | yes (SSLv3) | none

contrib/docker-integration/docker-compose.yml

@@ -0,0 +1,27 @@
+nginx:
+  build: "nginx"
+  ports:
+    - "5000:5000"
+    - "5001:5001"
+    - "5002:5002"
+    - "5011:5011"
+    - "5440:5440"
+    - "5441:5441"
+    - "5442:5442"
+    - "5443:5443"
+    - "5444:5444"
+    - "5445:5445"
+    - "5446:5446"
+    - "5447:5447"
+    - "5448:5448"
+  links:
+    - registryv1:registryv1
+    - registryv2:registryv2
+registryv1:
+  image: registry:0.9.1
+  ports:
+    - "5000"
+registryv2:
+  build: "../../"
+  ports:
+    - "5000"

contrib/docker-integration/helpers.bash

@@ -0,0 +1,21 @@
+# Start docker daemon
+function start_daemon() {
+	# Drivers to use for Docker engines the tests are going to create.
+	STORAGE_DRIVER=${STORAGE_DRIVER:-overlay}
+	EXEC_DRIVER=${EXEC_DRIVER:-native}
+
+	docker --daemon --log-level=panic \
+		--storage-driver="$STORAGE_DRIVER" --exec-driver="$EXEC_DRIVER" &
+	DOCKER_PID=$!
+
+	# Wait for it to become reachable.
+	tries=10
+	until docker version &> /dev/null; do
+		(( tries-- ))
+		if [ $tries -le 0 ]; then
+			echo >&2 "error: daemon failed to start"
+			exit 1
+		fi
+		sleep 1
+	done
+}

contrib/docker-integration/install_certs.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -e
+
+hostname=$1
+if [ "$hostname" = "" ]; then
+	hostname="localhost"
+fi
+
+mkdir -p /etc/docker/certs.d/$hostname:5011
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5011/ca.crt
+
+mkdir -p /etc/docker/certs.d/$hostname:5440
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5440/ca.crt
+
+mkdir -p /etc/docker/certs.d/$hostname:5441
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5441/ca.crt
+
+mkdir -p /etc/docker/certs.d/$hostname:5442
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5442/ca.crt
+cp ./nginx/ssl/registry-ca+client-cert.pem /etc/docker/certs.d/$hostname:5442/client.cert
+cp ./nginx/ssl/registry-ca+client-key.pem /etc/docker/certs.d/$hostname:5442/client.key
+
+mkdir -p /etc/docker/certs.d/$hostname:5443
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5443/ca.crt
+cp ./nginx/ssl/registry-noca+client-cert.pem /etc/docker/certs.d/$hostname:5443/client.cert
+cp ./nginx/ssl/registry-noca+client-key.pem /etc/docker/certs.d/$hostname:5443/client.key
+
+mkdir -p /etc/docker/certs.d/$hostname:5444
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5444/ca.crt
+cp ./nginx/ssl/registry-ca+client-cert.pem /etc/docker/certs.d/$hostname:5444/client.cert
+cp ./nginx/ssl/registry-ca+client-key.pem /etc/docker/certs.d/$hostname:5444/client.key
+
+mkdir -p /etc/docker/certs.d/$hostname:5447
+cp ./nginx/ssl/registry-ca+client-cert.pem /etc/docker/certs.d/$hostname:5447/client.cert
+cp ./nginx/ssl/registry-ca+client-key.pem /etc/docker/certs.d/$hostname:5447/client.key
+
+mkdir -p /etc/docker/certs.d/$hostname:5448
+cp ./nginx/ssl/registry-ca+ca.pem /etc/docker/certs.d/$hostname:5448/ca.crt

contrib/docker-integration/nginx/Dockerfile

@@ -0,0 +1,10 @@
+FROM nginx:1.9
+
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY registry.conf /etc/nginx/conf.d/registry.conf
+COPY docker-registry.conf /etc/nginx/docker-registry.conf
+COPY docker-registry-v2.conf /etc/nginx/docker-registry-v2.conf
+COPY registry-noauth.conf /etc/nginx/registry-noauth.conf
+COPY registry-basic.conf /etc/nginx/registry-basic.conf
+COPY test.passwd /etc/nginx/test.passwd
+COPY ssl /etc/nginx/ssl

contrib/docker-integration/nginx/docker-registry-v2.conf

@@ -0,0 +1,6 @@
+proxy_pass                          http://docker-registry-v2;
+proxy_set_header  Host              $http_host;   # required for docker client's sake
+proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
+proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header  X-Forwarded-Proto $scheme;
+proxy_read_timeout                  900;

contrib/docker-integration/nginx/docker-registry.conf

@@ -0,0 +1,7 @@
+proxy_pass                          http://docker-registry;
+proxy_set_header  Host              $http_host;   # required for docker client's sake
+proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
+proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header  X-Forwarded-Proto $scheme;
+proxy_set_header  Authorization     ""; # see https://github.com/docker/docker-registry/issues/170
+proxy_read_timeout                  900;

contrib/docker-integration/nginx/nginx.conf

@@ -0,0 +1,27 @@
+user  nginx;
+worker_processes  1;
+
+error_log /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log main;
+
+    sendfile        on;
+
+    keepalive_timeout  65;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+

contrib/docker-integration/nginx/registry-basic.conf

@@ -0,0 +1,13 @@
+client_max_body_size 0;
+chunked_transfer_encoding on;
+location /v2/ {
+  auth_basic "registry.localhost";
+  auth_basic_user_file test.passwd;
+  add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
+  include               docker-registry-v2.conf;
+}
+location / {
+  auth_basic "registry.localhost";
+  auth_basic_user_file test.passwd;
+  include               docker-registry.conf;
+}

contrib/docker-integration/nginx/registry-noauth.conf

@@ -0,0 +1,8 @@
+client_max_body_size 0;
+chunked_transfer_encoding on;
+location /v2/ {
+  include               docker-registry-v2.conf;
+}
+location / {
+  include               docker-registry.conf;
+}

contrib/docker-integration/nginx/registry.conf

@@ -0,0 +1,277 @@
+# Docker registry proxy for api versions 1 and 2
+
+upstream docker-registry {
+  server registryv1:5000;
+}
+
+upstream docker-registry-v2 {
+  server registryv2:5000;
+}
+
+# No client auth or TLS
+server {
+  listen 5000;
+  server_name localhost;
+
+  # disable any limits to avoid HTTP 413 for large image uploads
+  client_max_body_size 0;
+
+  # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+  chunked_transfer_encoding on;
+
+  location /v2/ {
+    # Do not allow connections from docker 1.5 and earlier
+    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
+    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
+      return 404;
+    }
+    
+    include               docker-registry-v2.conf;
+  }
+
+  location / {
+    include               docker-registry.conf;
+  }
+}
+
+# No client auth or TLS (V1 Only)
+server {
+  listen 5001;
+  server_name localhost;
+
+  # disable any limits to avoid HTTP 413 for large image uploads
+  client_max_body_size 0;
+
+  # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+  chunked_transfer_encoding on;
+
+  location / {
+    include               docker-registry.conf;
+  }
+}
+
+# No client auth or TLS (V2 Only)
+server {
+  listen 5002;
+  server_name localhost;
+
+  # disable any limits to avoid HTTP 413 for large image uploads
+  client_max_body_size 0;
+
+  # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+  chunked_transfer_encoding on;
+
+  location / {
+    include               docker-registry-v2.conf;
+  }
+}
+
+# TLS localhost (V1 Only)
+server {
+  listen 5011;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+
+  client_max_body_size 0;
+  chunked_transfer_encoding on;
+  location / {
+    include               docker-registry.conf;
+  }
+}
+
+# TLS localregistry (V1 Only)
+server {
+  listen 5011;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+
+  client_max_body_size 0;
+  chunked_transfer_encoding on;
+  location / {
+    include               docker-registry.conf;
+  }
+}
+
+
+
+# TLS Configuration chart
+# Username/Password: testuser/passpassword
+#      | ca  | client | basic | notes
+# 5440 | yes | no     | no    | Tests CA certificate
+# 5441 | yes | no     | yes   | Tests basic auth over TLS
+# 5442 | yes | yes    | no    | Tests client auth with client CA
+# 5443 | yes | yes    | no    | Tests client auth without client CA
+# 5444 | yes | yes    | yes   | Tests using basic auth + tls auth
+# 5445 | no  | no     | no    | Tests insecure using TLS
+# 5446 | no  | no     | yes   | Tests sending credentials to server with insecure TLS
+# 5447 | no  | yes    | no    | Tests client auth to insecure
+# 5448 | yes | no     | no    | Bad SSL version
+
+server {
+  listen 5440;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5441;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5442;
+  listen 5443;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5444;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5445;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localhost-key.pem;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5446;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localhost-key.pem;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5447;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localhost-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5448;
+  server_name localhost;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localhost-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localhost-key.pem;
+  ssl_protocols       SSLv3;
+  include registry-noauth.conf;
+}
+
+# Add configuration for localregistry server_name
+# Requires configuring /etc/hosts to use
+# Set /etc/hosts entry to external IP, not 127.0.0.1 for testing
+# Docker secure/insecure registry features
+server {
+  listen 5440;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5441;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5442;
+  listen 5443;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5444;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5445;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localregistry-key.pem;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5446;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localregistry-key.pem;
+  include registry-basic.conf;
+}
+
+server {
+  listen 5447;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-noca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-noca+localregistry-key.pem;
+  ssl_client_certificate /etc/nginx/ssl/registry-ca+ca.pem;
+  ssl_verify_client on;
+  include registry-noauth.conf;
+}
+
+server {
+  listen 5448;
+  server_name localregistry;
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/registry-ca+localregistry-cert.pem;
+  ssl_certificate_key /etc/nginx/ssl/registry-ca+localregistry-key.pem;
+  ssl_protocols       SSLv3;
+  include registry-noauth.conf;
+}
+

contrib/docker-integration/nginx/ssl/registry-ca+ca.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE9TCCAt+gAwIBAgIQMsdPWoLAso/tIOvLk8R/sDALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTQwMVoXDTE4MDUxMDIwNTQwMVowJjERMA8GA1UEChMIUXVpY2tUTFMxETAPBgNV
+BAMTCFF1aWNrVExTMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1YeX
+GTvXPKlWA2lMbCvIGB9JYld/otf8aqs6euVJK1f09ngj5b6VoVlI8o1ScVcHKlKx
+BGfPMThnM7fiEmsfDSPuCIlGmTqR0t4t9dHRnLBGbZmR8JdAs7LKpP+PFYu0JTIT
+wFcjXIs+45cIF2HpsYY6zkj0bmNsyYmT1U1BTW+qqmhvc0Jkr+ikElOQ93Pn7zIO
+cXtxdERdzdzXY5cfL3CCaoJDgXOsKPQfYrCi5Zl6sLZVBkIc6Q2fErSIjTp45+NY
+AjiOxfUT0MOFtA0/HzYvVp3gTNPGEWM3dF1hwzCqJ32odbw/3TiFCEeC1B82p1sR
+sgoFZ6Vbfy9fMhB5S7BBtbqF09Yq/PMM3drOvWIxMF4aOY55ilrtKVwmnckiB0mE
+CPOColUUyiWIwwvp82InYsX5ekfS4x1mX1iz8zQEuTF5QHdKiUfd4A33ZMf0Ve6p
+y9SaMmos99uVQMzWlwj7nVACXjb9Ee6MY/ePRl7Z2gBxEYV41SGFRg8LNkQ//fYk
+o2vJ4Bp4aOh/O3ZQNv1eqEDmf/Su5lYCzURyQ2srcRRdwpteDPX+NHYn2d07knHN
+NQvOJn6EkcsDbgp0vSr6mFDv2GZWkTOAd8jZyrcErrLHAxRNm0Va+CEIKLhswf1G
+Y2kFkPL1otI8OSDvdJSjZ2GjRSwXhM2Mf3PzfAkCAwEAAaMjMCEwDgYDVR0PAQH/
+BAQDAgCkMA8GA1UdEwEB/wQFMAMBAf8wCwYJKoZIhvcNAQELA4ICAQDBxOHKnF9z
+PZWPNKDRmBPtmnU2IHh6JJ9HzqGALJJbBU0MUSD/aLBBkYeS0YSHgYZ1hXLsfuRU
+lm/czV41hU1FTDqS2fFpcAAGH+6/rwyfrz+GYr2K4b/ijCwOMbMrDWO54zqZT3KU
+GFBpkrh4fNyKdgUNJsy0Q0it3gOGSUmLvEQUzqxPFVz7h/pF/Cecr0/kpjbpsxna
+XQkhtDyKDIQfPCq8Ci1vox5WvBbBkdzDtyCm+KSb6VC3pCX6LV5NkS7YM7mtscTi
+QdYfLbKX05kUVG2R9SShJn5BSXzGk9M5FR5koGY0lMHwmJqaOqazXjqa1jR7UNDK
+UyExHIXSqJ+nCf4bChEsaC1uwu3Gr7PfP41Zb2U3Raf8UmFnbz6Hx0sS4zBvyJ5w
+Ntemve4M1mB7++oLZ4PkuwK82SkQ8YK0z+lGJQRjg/HP3fVETV8TlIPJAvg7bRnH
+sMrLb/V+K6iY+08kQ2rpU02itRjKnU/DLoha4KVjafY8eIcIR2lpwrYjx+KYpkcF
+AMEC7MnuzhyUfDL++GO6XGwRnx2E54MnKtkrECObMSzwuLysPmjhrEUH6YR7zGib
+KmN6vQkA4s5053R+Tu0k1JGaw90SfvcW4bxGcFjU4Kg0KqlY1y8tnt+ZiHmK0naA
+KauB3KY1NiL+Ng5DCzNdkwDkWH78ZguI2w==
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-ca+client-cert.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE9TCCAt+gAwIBAgIRAKbgxG1zgQI81ISaHxqLfpcwCwYJKoZIhvcNAQELMCYx
+ETAPBgNVBAoTCFF1aWNrVExTMREwDwYDVQQDEwhRdWlja1RMUzAeFw0xNTA1MjYy
+MDU0MjJaFw0xODA1MTAyMDU0MjJaMBMxETAPBgNVBAoTCFF1aWNrVExTMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq0Pc8DQ9AyvokFzm9v4a+29TCA3/
+oARHbx59G+GOeGkrwG6ZWSZa/oNEJf3NJcU00V04k+fQuVoYBCgBXec9TEBvXa8M
+WpLxp5U9LyYkv0AiSPfT2fJEE8mC+isMl+DbmgBcShwRXpeZQyIbEJhedS8mIjW/
+MgJbdTylEq1UcZSLMuky+RWv10dw02fLuN1302OgfJRZooPug9rPYHHGbTB0o7II
+hGlhziLVTKV9W1RP8Aop8TamSD85OV6shDaCvmMFr1YNDjcJJ5MGMaSmq0Krq9v4
+nFwmuhOo8gvw/HhzYcxyMHnqMt6EgvbVWwXOoW7xiI3BEDFV33xgTp61bFpcdCai
+gwUNzfe4/dHeCk/r3pteWOxH1bvcxUlmUB65wjRAwKuIX8Z0hC4ZlM30o+z11Aru
+5QqKMrbSlOcd6yHT6NM1ZRyD+nbFORqB8W51g344eYl0zqQjxTQ0TNjJWDR2RWB/
+Vlp5N+WRjDpsBscR8kt2Q1My17gWzvHfijGETZpbvmo2f+Keqc9fcfzkIe/VZFoO
+nhRqhl2PSphcWdimk8Bwf5jC2uDAXWCdvVWvRSP4Xg8zpDwLhlsfLaWVH9n+WG3j
+NLQ8EmHWaZlJSeW4BiDYsXmpTAkeLmwoS+pk2WL0TSQ7+S3DyrmTeVANHipNQZeB
+twZJXIXR6Jc8hgsCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgCgMBMGA1UdJQQMMAoG
+CCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwCwYJKoZIhvcNAQELA4ICAQCl0cTLbLIn
+XFuxreei+y6TlG2Z5XcxJ84mr8VLAaQMlJOLZV0O/suFBu9KqBuvPaHhGRnKE2uw
+Vxdj9qaDdvmvuzi4jYyUA/sQuqq1+wHwGTadOi9r0IsL8OxzsG16OlhuXzhoQVdw
+C9z1jad4HC7uihQ5yhl2ltAA+h5G0Sr1b9El2mx4p6BV+okmTvrqrmjshQb1GZwx
+jG6SJ/uvjGf7rn09ZyYafF9ZDTMNodNXjW8orqGlFdXZLPFJ9agUFfwWfqD2lrtm
+Fu+Ei0ZvKOtyzmh06eO2aGAHJCBTfcDM4tBKBKp0MOMoZkcQQDNpSyI12j6s1wtx
+/1dC8QDyfFpZFXTbKn3q+6MpR+u5zqVquYjwP5DqGTvX0e1sLSthv7LRiOi0qHv1
+bZ8JoWhRMNumui9mzwar5t20ExcWxGxizZY+t+OIj4kaAeRoKK6r6FrYBnTjM+iR
++xtML5UHPOSmYfNcai0Wn4T7hwpgnCJ+K7qGYjFUCarsINppQEwkxHAvuX+asc38
+nA0wd7ByulkMJph0gP6j6LuJf28JODi6EQ7FcQItMeTuPrc+mpqJ4jP7vTTSJG7Q
+wvqXLMgFQFR+2PG0s10hbY/Y/nwZAROfAs7ADED+EcDPTl/+XjVyo/aYIeOb/07W
+SpS/cacZYUsSLgB4cWbxElcc/p7CW1PbOA==
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-ca+client-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAq0Pc8DQ9AyvokFzm9v4a+29TCA3/oARHbx59G+GOeGkrwG6Z
+WSZa/oNEJf3NJcU00V04k+fQuVoYBCgBXec9TEBvXa8MWpLxp5U9LyYkv0AiSPfT
+2fJEE8mC+isMl+DbmgBcShwRXpeZQyIbEJhedS8mIjW/MgJbdTylEq1UcZSLMuky
++RWv10dw02fLuN1302OgfJRZooPug9rPYHHGbTB0o7IIhGlhziLVTKV9W1RP8Aop
+8TamSD85OV6shDaCvmMFr1YNDjcJJ5MGMaSmq0Krq9v4nFwmuhOo8gvw/HhzYcxy
+MHnqMt6EgvbVWwXOoW7xiI3BEDFV33xgTp61bFpcdCaigwUNzfe4/dHeCk/r3pte
+WOxH1bvcxUlmUB65wjRAwKuIX8Z0hC4ZlM30o+z11Aru5QqKMrbSlOcd6yHT6NM1
+ZRyD+nbFORqB8W51g344eYl0zqQjxTQ0TNjJWDR2RWB/Vlp5N+WRjDpsBscR8kt2
+Q1My17gWzvHfijGETZpbvmo2f+Keqc9fcfzkIe/VZFoOnhRqhl2PSphcWdimk8Bw
+f5jC2uDAXWCdvVWvRSP4Xg8zpDwLhlsfLaWVH9n+WG3jNLQ8EmHWaZlJSeW4BiDY
+sXmpTAkeLmwoS+pk2WL0TSQ7+S3DyrmTeVANHipNQZeBtwZJXIXR6Jc8hgsCAwEA
+AQKCAgBJcL1iR5ROMtr0ZNIp4gciALfjQVV3gb48GR/e/9b/LWI0j3i0sOzeLN3h
+SLda1fjzOn1Td1ma0dZwmdMUOF+hvhPDYZfzkwWLLkThXgLt/At3rMYstGWa8pN2
+wVUSH7sri7IHmYedP3baQdrHP/9pUsGQc+m8ASTE3i+PFcKbPe5+818HTtRrhVgN
+X3oNmPKUNCmSom7ZcKer5P1+Ruum0NuDgomCdkoZgfhjeKeLrVjl/wXDSQL/AhWA
+02c4/sML7xx19nl8uf7z+Gj0ir1pvRouhRJTwnRc4KdWu+Yn7WLU8j2ZKf5St/as
+zjnpYVEdCp0KSHccgXtobUZDEG2NCHmM6gR2j3qgoUAYjHyqPYlph2r5C47q+p4c
+dDWkpwZwGiuYq9qpZj24X6BfppxExcX6AwOgFLZLp80IynwrMVxFsDd2J+KpKRQ1
++ZtYPcULwInF9MNi/dv84pxGOmmOaIUyjN8Sw4eqANU4T5uvTjUj7Ou6KYyfmxgG
+y++vjpRN7tN1t1Hwde8SVWobvmhU+5SJVHV8INoJD7uciaevPo9pt833SQTtDXeY
+PVBhOKO7thAxdUiqlU/1nGTXnf1VO6wAjaVYoTnP4tJ97WuTptwd2F5znVWHFGVh
+lzJAzmFOuyCnRnInsf4n5EmWJnT7XF2CofQqAJ8NIddrU8GnQQKCAQEAyqWAiPMK
+I/dMzlS7oJGlhbKZ5R4buc+EoZqtW7/8/S+0L6IaQvpEUilD+aDQyaxXjoKiQQL+
+0UeeSmF/zU5BsOTpB8AuJUfYoUe0N+x7hO5eIcoCB/QWYX+iC3tCN4j1Iwt6VliV
+PBYEiLUYPngSIHob/nK8UtgxrWQ3Fik9XJtWhePHrvMvDBalgCKdnyhuucGxKUjc
+TtPcyMFdi0z4Kt/FAm+5u/v4ZkO909Ish0FrAqQ9t5ETfvTTTYKBmzny6/LSPTK9
+0XIsHltuC1xG4vGQsES/Ph++Yj3Vn011FqvFZeBUHbfcQuB4h5wcb+90d4GU1kux
+eabsHPIZKrlN4QKCAQEA2Fs8NAN5K9i7qbxZCJPi6DJV6XMznk6JVGb+qkkChCyq
+IOXb95+c9CIpe6w2d3res3zvML3zbdz2Lyp9G0ve6tSlOaSnHeyIxZ5SRB+yQrcF
+GXtsx370bOGjCi1/NH85kwKlMuROFJKleJQv8rKpIEo5aPSPV9Cc/VsUqBpvR+O0
+U1HMv57P4yJA/ddw6imHJBl3jTmWBpK4B+LBsCbdypxdVoO8t32Lb2BqDTaPJfYU
+RJUpjn/efLLoP6CWxYtqpUlY5tc7NJGAokl8Fo1mPn02klydvs09uiXE80Li2Hoc
+/meMH07Lbt2VTw6iGNRX6VpIHEUZGZeS6rbAvO4ZawKCAQEAjOtGVPXdyWEB0kHu
+MBzYY/7tMf0b/rymWNL9Vt5NiauQu8cYSBdNR21WzdLdHkFwqbOCLX9twA7zrnna
+q+SNnfuxaShlbptls9HvKyySQMCaSRj3DJzaq3ZcM2vFgmUFQxeKPV1geeY9xOta
+LqbExDzmFq2m9F1PPmqAPDL1bt6+7mCVzb1irB9be52WysUNKrPdBP6b5V1DHYAK
+EwK1WOs/TxBusqDn/gWBjjmLqYr+ZVndaTfDvPd3sWDdzBoiKZ40QUZ15Z5lu76M
+6e2DhfHCUjGcZBEjDaI+WYc9s0REAzJajEf9Lax3ZKZUyCpWbXx5CgSdKCHB8+cP
+RTyTQQKCAQEAsxx8r5a8hocLfQ43Kvm7HH0nUHeVoRXlbOFDLNf6ZE/RnCCOxOX3
+esiZTRAZmzo2CaOBJPnr/+SwTgW/woxCBGh8TEc6LnS2GdviwRD4c3CuoRTjzhgU
+49q8Ld3SdDRrBoBnIMWOuktY/4S2WRZ9GwU3l+L2lD1Y6gmwBSa1P2+Lxnpupagk
+9CVUZpEnokM05LbMmTa2M8Tc43Je5KSYcnaWctvmrIUbnN3VjhC/2y5oQwq1d4n2
+N4eo65vXlbzAUgtxtNEz62YVdsSdHNJ8dXkVZ3+S+/VPh75i2PxjbdFSFW7Futlx
+YtvAEs3LdgC8squSDQ1LJTutXfBjiUUX9wKCAQBiCMre86tLyJu6Qb6X1cRAwO7m
+4kyGzIUtijXko6mWxb4X/usVvzhSaNVYbHbMZXjX+J5vhBOul+RmQ3EY6nw0H2z8
+9D4z/rnQVqeb0uvIeUhBPni+s4fS4bA92M6Ie5bhiOSF2JjjJr38BFnTZARE7C+7
+ZII7z2c0eQz/wAAt9fWWroAB2mIm6wxq0LNij2NoE0iq6k2xJE1/k8qhXpsN0zAv
+bjG72Q7WryBeK/eIDK9e5wGlfLVDOx2Evlcaj70oJxuoRh57e8fCYy8huJQT+Wlx
+Qw4zhxiyzAMq8SEqFsm8dVO4Bu2FwzmmehA80ieSb+si7JZU92xGDT394Im2
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/ssl/registry-ca+localhost-cert.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIFCTCCAvOgAwIBAgIQdcXDOHrLsd2ENSfj5h8ZmjALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTQwM1oXDTE4MDUxMDIwNTQwM1owJzERMA8GA1UEChMIUXVpY2tUTFMxEjAQBgNV
+BAMTCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2K
+saEVcHq0eldu5kABbWtZsf9keK7lz8beVIowzOqp5IHpGlggtH7xDVeigA/sLdds
+WTgKEOq3zsJzdgfEti5TNAjjmPqjMKkolqv3LXDJG0dZ2GZ8W/eBB6X1wB0LKr3i
+ye3/5jb/wCZYVGGMQXj0VQxY8Qq+OHEp0effeheJqA0OYOj+RaZwi20OR/KmJRgY
+wXU33bZyapuyT4krhFlFbtzXeKsKQPrT2ePWxPAceqUGUTIqyJySYIw6vb72YxjX
+FNRw6Jg7B7RqVJaVCfBrVxtAv+rCLOhUOVYmWhgWEIODPXiqOGwB0VUApAVAYqfi
+TYnJIZ7QYLlQx5VPNlzZuSJTUzKmHQLtLcTqdO5HmLxfxc0WuS/ftK916wy/jpSc
+m2DiHjIy6aAEaHKGQrNgT+no68kp30xkYAVsIs0BFpl6Q2iNr5e0uKta82A0xU1Q
+we7swSHOHCevuDZfFA/CqnBptOjvNUuVytcroCeCrV/ftp75w/Fd9zOcb6LGLxM2
+2UzhkSXl3II250xj74Q3q8T9TDxCLty7oiawhaYKI+8SDYc510EQ7MH46WMO+3Uq
+JkpmmELd9POgnnZ1JrCFmf0flUKTi2CqU3wrBPpPMwFBxoFipp5iL87npACHc3DY
+6uaoF4Pf9Et1Fd7HRon8RMsKkrSF92NFiBx5UvhZAgMBAAGjNjA0MA4GA1UdDwEB
+/wQEAwIAoDAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDALBgkq
+hkiG9w0BAQsDggIBAC0F4ci1nqZ9KUhEEAmWmy8g89DovNNIGSC51r2WJ/COmYUX
+X70TONscsBL/kx5MK4xoAmb+EN6Yy8i+z9NkNJd0B+2MjXPMFBpgGb0UiPv2wEmZ
+5PAKyjwTxNIm6L/nFhkmVqfsQHfjHukXES4C0ff6fj6fuDpBfl5nTlVmc9LpP+hT
+5RAwW10qumucGxAWGNBWW+K66cf8O7n/0nQykxJxYjBx16ZB80H2uvqFDKDVFqze
+co5M4euXQq9KiXPRlcC9rab2a7FGLHd0TyPkq6TvfsqpxcryyKS4rIAz3sQh/tl/
+/qm1tBcZW2bce3UlF2Wb2dW9HqvIu1O84f6ptLqwgKcIdTbwgQZ0kbFoWE2kWJSV
+w+eAFb7tz1LDTpF3NRlz+1K27pBQWRQgcqoIRoQXpC0LfQY9Mp70QIfUQdUh6tnO
+8hmq5y623tfxiDwCxb/EOpwCmwK1Cp9cloZTDefVE1r6NkEJWeeHG79VljUGF1KT
+NKzXWrrsFtge/hU9Pj+frcZO9qExxPCcsrdZcoK7Ll8s+pjulRvbnCnJkNpeOI3P
+iz6+sdGmzKSKg2daRM67Zmy5tmlBEX/eV7kFqt+b3HsdUiLo3Ng2lyPLNNDfwUtB
+EukgYGjVJoyqLjLXgsCxLJlk7X/ogVwf8SlAnQ7p6KuxGWm02vlUpEmJp+Hq
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-ca+localhost-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEArYqxoRVwerR6V27mQAFta1mx/2R4ruXPxt5UijDM6qnkgeka
+WCC0fvENV6KAD+wt12xZOAoQ6rfOwnN2B8S2LlM0COOY+qMwqSiWq/ctcMkbR1nY
+Znxb94EHpfXAHQsqveLJ7f/mNv/AJlhUYYxBePRVDFjxCr44cSnR5996F4moDQ5g
+6P5FpnCLbQ5H8qYlGBjBdTfdtnJqm7JPiSuEWUVu3Nd4qwpA+tPZ49bE8Bx6pQZR
+MirInJJgjDq9vvZjGNcU1HDomDsHtGpUlpUJ8GtXG0C/6sIs6FQ5ViZaGBYQg4M9
+eKo4bAHRVQCkBUBip+JNickhntBguVDHlU82XNm5IlNTMqYdAu0txOp07keYvF/F
+zRa5L9+0r3XrDL+OlJybYOIeMjLpoARocoZCs2BP6ejrySnfTGRgBWwizQEWmXpD
+aI2vl7S4q1rzYDTFTVDB7uzBIc4cJ6+4Nl8UD8KqcGm06O81S5XK1yugJ4KtX9+2
+nvnD8V33M5xvosYvEzbZTOGRJeXcgjbnTGPvhDerxP1MPEIu3LuiJrCFpgoj7xIN
+hznXQRDswfjpYw77dSomSmaYQt3086CednUmsIWZ/R+VQpOLYKpTfCsE+k8zAUHG
+gWKmnmIvzuekAIdzcNjq5qgXg9/0S3UV3sdGifxEywqStIX3Y0WIHHlS+FkCAwEA
+AQKCAgAtZw3V8P/+el1PpqoCsNzpqwvQn36bc3CKvPwtM1tJQa2Q92V3DQdr9rDg
+7pjGkankpGorKScH4ZLseLy2h5aKRCZm9PS/DhbbCs1wrDhtO5AxeKYPGhYNiOpx
+VvwuHQ/Pohfmdn7KgNrKrW1WIBW5CWN+2X4mq2Gk6aYLHgKZSeB3mf1st6mNRACW
+RZg5OZKW3VMv0a/l3cVaeqooXwQ/PtUkXhMp3ILnnKly3Gulzi2gIyj3EQ5vODSe
+O3gND/UZOJwwgGG6Aief4fnDc7an+c1OSgBr8OVC21Ys3dfQWWV0os9gVFhymX8k
+2AgRf6jP93sFw2NSY34KvcGZpKG59oMDxWF1vPo8sOt17Ey0+qp3eUtB3FfE7Wtf
+BaLaD/x4U91izIqOEMzQ6QiZAyvmUoBkUSo125CYuIkt8C8Q1lA1KjihETWF37QR
+mr8LUk0A0x3SErtm4wVfeDEqVSfI9gKpk6i6rlUzuCjv58Rc0yyqoghXwBWM4CKj
+5ZHYpBKAxj4bM6IrKnodAOcsyVk2c2zVTaMxPhoUj0fF7IE5Hy6YAQ/yBheZEM1v
+fhsdBFyS6OqSCnN6UinhH268QPam82lfKTFjW5lOgsSDQZ9rhiWoyamhonJTq65I
+nb08f4mzT6OGMwV13zq8dXio6WnUIQAhXdEYWrMBmxp5b6CxAQKCAQEA4kmwV3Nb
+n3ZIzVAp2l+yGZwdg4YWzN2kcfdNkL8I+Pn8pWrOwv/uGQYmM0786ys9kB5lu4FR
+TMcoEo3AaK/z8N49ro2Kl6HcTmxZgTMr+cl6iwetzqYdkRK7klxyCv5uVloDQDtc
+AulDH6RkW9BfRERpi6XtlgiFdJj5jMvXMpwGHX69JVsXb83ZSQESjI2JfO9Y8+4M
+a7hNKWW/W0ZBrGCcQQPbgpysfJ+PFKUF/yF1h8SSCdetW2Kv2ix16wL5uHKINYmZ
+Y/Om+/AFnUOQlANycgThtgBI5mvg9Khq6W2i/RNcIL7bvwAzq1p+o6cGnImXo4bY
+hC4fs2/aeX17UQKCAQEAxFQHSLBYDLal5CQYbHbNZ2sLjwRUraEd/+BA8XoERVVQ
+JPihgEvTPEaHnWrFTw0qaGKgMZ5SZCZSWUIfXjYvQIUcEMhNUOHweXhJJhifO5sd
+sTuvU7bWg76F69bRKfp8KM266m7qMYv+tNlQ6Kbz/1ImsW00xb86vCK2hPfhldtN
+d/iBb4HVDu1uoATHUNuqsSGj/UvttKudQdg7MapzM4N+D4m6rPZUjQmtoMWOXt7R
+LYrqEOHWfkxXKlVHw1cL9uzUpArvnR0VcYvGfXiYJFbXWsEB07VxIoLMPEtPbpH9
+YLY37KugrthEVnsbySmZIWCRDEqQuuAaa5o8S1naiQKCAQAiU/dybMebe0A0FVMk
+E5xbEjnP+AmBbqZBu7iCmthrnNDc70UKg/TEyxAEfJkVu+uM72+TcFy6/wNvPR3R
+Q9AH3E8TKdm6gw1+wCUb2n1zWUND0Bhn3v9hQKw/2dJbJJnsc59GoTqmHmjWZgPr
+gcLSAmbYjoVqW0STmZlR6KJuxQiQdOeQwS7fASVTU9xSgi43S7/80UIFHWJnQ04y
+NIhF9CoAGuuz9ryb80CraxVrzNGdlQ5qe9OKp3/x4wjIbB0iBA3xwTwJ066jTZgs
+cVF/gr5b2a28BHMKsZbgxqPhYYZ2SfeR6CJB6W/tML9BaFcybBUa85vpAW5BtFg6
+UfThAoIBAAp1/71byBVFVimF0tdUrTUpewAv1uM5hoOvy0YSnk+jcBXIObLAV40K
+pQc6PTEtHmlZd/es2+8CK7kd0NYQRQxHC2vJgHUi1NFkG2GwRivC5B4hdAId5+g1
+KqWaWKLH+f2imKcNKeVh9Dxmp+z9mFquYelqTDmNKvADWX5URuzZNpOB5kOuw098
+TzyvhH9GdR3jEP3aIdxSmJp9jwnibyj7hKgHSq8UoQSy01GRtThQ3wxyLm6f2fH4
+11wmFyDNbpHFpL7o5kOU3SOjsvvUhSbKiccIKbTCIjkYhxFfYegeV0Xj767opjMq
+ytlgzeY2FTa2EoR5JKUQc9fv6+6H5yECggEAVVfnywPm8QXn+ByFDdUndZg3uEje
+DGyvt1M3mIz5geyRZO8ECzgsZVzKgZC8jDB4lPKz3AGgNlUl/vyGHk6CtW6V6ePA
+EXcmOkkMKJQMdopY2/cE6YlSpBGMCcnfothgL0HXxYoop4xVjb74k7tFcNrIDoRx
+zp9dSalgxx9aMeaURRbMWf8AhWLZUAjJ/359M1SmcNW619SL3p8Q95Nptvdiltww
+lWOCkBdgkjW0mel+Mi2+gY8UPmgNBMPrJ1z9b7b7529YCv5Oci8ABn/N202nhjCp
+LupADooNknOMLDyqwRorEv4g6wRjuPIYTIhI9fO5ranu089x+mmGU2tCBw==
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/ssl/registry-ca+localregistry-cert.pem

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFETCCAvugAwIBAgIQJ+iLgsp9gA0DmROqW+tHFzALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTQxNloXDTE4MDUxMDIwNTQxNlowKzERMA8GA1UEChMIUXVpY2tUTFMxFjAUBgNV
+BAMTDWxvY2FscmVnaXN0cnkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+AQDHR/A6uiQ9X/Xh5ivmdjRr5XVr1D7+fU9Qu6ohArqtBuJsLr6t2RBTS9w6PIAf
+xjQSMSFlrm/CY+hbfBMSgm9NeH23o3kYCgoEPhP/634A45W5xwUFno388U8/NHK7
+qwzSP1ezKXfXNvzuo1mZhT08aVdGMOrZUcZZZl8R3RPcIRw9XDSfXKVkMluH6egk
+8iLdOxdIdRS58DeSI09FskWe3cIZ5kJmMqnKoIbYSJCVVeYPO0RFlIBi+zpdVyI/
+r9LG0r0plRdz/HJevbOitU2y93S1s9NWMNEkOFU1PFJmsF3ZzNqJFCySj00y/Hcs
+jPULYwIxYdqcv16cTNmd3P6FegvuzLJLjNuGaLJGc1antv+p62P7ZdE3DyprFuxs
+MJgDL9+NjDaIzoamFf0Uv7K3F7hxrrAHfvm1CMUOyQLg9J6Wl4mLsOy2ZhCbdNFs
+T6dobAUGvz4Muj9V8V5pR+nFehjmsPENSsTcs5j0e8zTWtvMFISdS+NZAkpiz0s4
+PV8DLgk5Rp1ZG2V5OnRPLMOTgK0nngc5GVaxf7OYCrFHbBJ8tL93MXNQptNFeBpV
+FhjUGqVFcz+6nbFX2NsFLZnghQRs9lej4TTG33NSAYusKqhVwpYFf8CsXCcvYuU6
+RlkCYjr3PB+nX1UDa0eUGm0zOabf9O3D1VzHQBpDuzSHQwIDAQABozowODAOBgNV
+HQ8BAf8EBAMCAKAwDAYDVR0TAQH/BAIwADAYBgNVHREEETAPgg1sb2NhbHJlZ2lz
+dHJ5MAsGCSqGSIb3DQEBCwOCAgEAaPfAs6saij4FZIPbzAb5M6ZVvfXBg+AfH52t
+p3tFsnWUJCiOh9ywsc2NcmJdleKDc4/spElFMUarHqcE1ua6EH15O5GEnHWKj8EY
+PVQFrPvf30UkRGNPl8eC7afZtCNk9MLllIATAzBr5Z1i+psV7MmgBKpbZ4B0TnhR
+GXNT60QaCJ9RfUuc2z7RHJNo9XTn3Q44X7TFj+P3jHOWzTf8y6Mz6saTy2bugIUy
+AfRgRgq/bB8hRjrazg55FIlrMv7dr3J0cIuqmaHfsw7Q2ECMCXW8oQXMBzfuIT0n
+sG4u0oVxdNx4OdHsAubGjjwNDhxJvN5j8+YFqZMu03i8LbyamTwsrZg2C3QrRUq8
+SujQEEB+AmO0lpuJ24FsOOYVSYCpLy2ugrKOr2NUqbiBKZs8uBh6RGACfunMZlEw
+4BntohiO7oZ5gjvhGZNUEqzMChw7knvVjZ+DkhFk9yE4qIL7VsJSUNI2ZJym/Xeq
+jr/oT8CpP8/mFZspa6DFciPfhGLQqKcaZZohL7461pOYWY5C2vsJNR2ucBZzTFvD
+BiN/rMnIGFrxUscCCje6RLmrsZ3Lb7bfhB3W6kwzLRfr/XEygAzx6S2mlOM34kqF
+HFpKrg9TtLIpYLAKAIfuNbrLaNP1UKh7iLarhDz/qDcvRka/qJTzLD3eLeGXefAP
+KjJ1S7s=
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-ca+localregistry-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAx0fwOrokPV/14eYr5nY0a+V1a9Q+/n1PULuqIQK6rQbibC6+
+rdkQU0vcOjyAH8Y0EjEhZa5vwmPoW3wTEoJvTXh9t6N5GAoKBD4T/+t+AOOVuccF
+BZ6N/PFPPzRyu6sM0j9Xsyl31zb87qNZmYU9PGlXRjDq2VHGWWZfEd0T3CEcPVw0
+n1ylZDJbh+noJPIi3TsXSHUUufA3kiNPRbJFnt3CGeZCZjKpyqCG2EiQlVXmDztE
+RZSAYvs6XVciP6/SxtK9KZUXc/xyXr2zorVNsvd0tbPTVjDRJDhVNTxSZrBd2cza
+iRQsko9NMvx3LIz1C2MCMWHanL9enEzZndz+hXoL7syyS4zbhmiyRnNWp7b/qetj
++2XRNw8qaxbsbDCYAy/fjYw2iM6GphX9FL+ytxe4ca6wB375tQjFDskC4PSelpeJ
+i7DstmYQm3TRbE+naGwFBr8+DLo/VfFeaUfpxXoY5rDxDUrE3LOY9HvM01rbzBSE
+nUvjWQJKYs9LOD1fAy4JOUadWRtleTp0TyzDk4CtJ54HORlWsX+zmAqxR2wSfLS/
+dzFzUKbTRXgaVRYY1BqlRXM/up2xV9jbBS2Z4IUEbPZXo+E0xt9zUgGLrCqoVcKW
+BX/ArFwnL2LlOkZZAmI69zwfp19VA2tHlBptMzmm3/Ttw9Vcx0AaQ7s0h0MCAwEA
+AQKCAgBd61qd4vKHdn1kzNztzdHg9BDGFA7oU9iYvQlua2HdgDwgLluxhXa7Oyp8
+y9y6nOgXls4dpPuJCxsMWsqGU7DvOxVNAh9lI/4ah8NXPv5wntIG73Q/dL2Ic5Yc
+vLRCHFh7klzb1HRlmsXUFmp4/yGgIil+rDlS2MZ5hdTSj3X3ricoCBfI75oHQfB/
+es7s8q1ZxKqxfHSbOUqHdlq7B0zmla8QE8RBdCkvlT5YGsMBjq1RimYfwOBNRgf4
+y8MZbt0Q1WtPeLPH9zdTzWYnDfmjmhqINEsq+PDoeCA4aciQGxjwOCrapgZnwF/q
+4q+r8HbgufXjnjGw5ERLt7BsRSYynoJiTWQ3p/wZ2VLpjFtxYxoJ5/qpQvbZMgGS
+Yu3FZNC6cnbOs+JWbdm7Kg93N24cBrGdk/KdEE6lz6uQq07FTSqLtPEQWePzBiuA
+1wfP78b2AH6vyJKq36EfMCJK2i7rpwtNz7d9NI5kiLRDB7gesqC94WJ+psEu+ErO
+w9DbTV3xdOPs4FGGrR41Hbo8emrk6smhb8+VK2odggi8i2CLAkYupMsuobBlX3CL
+hyJPfWDv1aREJ1w7zWVQlJkvp5zR0oXZXpfFxjpj7Ypbp7BKxmh5+WYj8msFDfaD
+8VQ+pqgPpdl6zElEq9m5koHjsHH57fMeJQ59HiWpWFur+kQx4QKCAQEA0Jnvbm7R
+WypbPDInkIoPDIhyP9Pqv+wMzNfYEnVEG0GhEU/H5aE20a+Dm6u0bsmPm5lCSQsu
+EvylTSL3yumQZMincNIUXcPYb2Qye/ZzJnMIibCqwMKQqi4HxCXprWhiEoGPum8A
+fN0bTGgMYfM6JZ/Dh1eGsEvemeW+5tn5xZF4Lfp/vkT8v4FuHDydUF/lIx7F5MMi
+VteS0hHnR1DuvxHqtysf0wy2l61LFr7mQCMYTNEyFB3ZfXqpxJmFmCqPbr4PQsIm
+2rqIDw+13eeoyDpJJkdi+yzHkAYDOdAsur0vOQvK/Zj1QKz9qmC1O6L4BN5yp265
+vjSE4Orvo7btEQKCAQEA9I/afLw6lHUJ4FVL0p7dH15JSFjt7nmGHocE7Wf6Yp3G
+vMp+PdGyoJ2KEQB2unnQZK1gZqUuRQLannjNl7fsIiIhHgHxMBCIiylwSUVnP868
+u9/fpJV/cSGze2zF0WAttIgXKNtXG7xMntcY2k+SAe0qjqX494KT0NGnznySt2nU
+A1YlkXm6u3KCOJrBKfbtiHXFoH39sA+ihuPiV7xcETS2ZrFdAX9M422p4yDHqe/0
+dTe18wIxJNiEX4xp/HRE//cuQ5dw/Z/QmNrzgWxHbOmXVR5C90vIJRuYY9xz0tDP
+LMnifSKfnG16l2gqg7zb8xsxYqSGndXWKPAeiq3/EwKCAQEAhCWQbWgcjmFFzNuE
+/ubG48yoe9DW/OAft8Dg68iH7bBkxd/BpbG8VZeXiw16T1i29f5f5IAFnxeX7EbD
+rTLLO1113V3ocwH3YZGa/bbBedETzo4xjc1z8asZVmQiJa1ju4+CKrvZFkDH415i
+wcZgxqbwKhQDijl1+g52Ii5iMYuXE6GGPVXcu8DVrWOk0N7+/IGpIeOQJG2KYDPh
+TOdzZ22FQKY8EeoS3gF0+SLUIDtbUIaR7/Z86iXD2HzdCemkVaZnaoYuMRBL0ybD
+sqDn5nguEObWSII0pgN5Fa3QODhS6xOSc5brfx5X0BBVn0L9VbBJ99GIL3t71jRe
+vVrL0QKCAQB+jUYZT+ncUqgWruy6g7yW89pmFqagxb/SYjn5g9m8WDq0DPDAmped
+p4f/fkbx/gEJZ/I/i3BjA7QPVyHERcdqblDGz2h4X8XYhUv2jnR8P0XIznNTHo1B
+BJh04PeIfgWIqveZC8+KqajYdSQGLDC40Ho6MMahha9p2mPEZRAi2x97zoNIQT6Q
+qxOZqPMV/RIzkAYBI9E33w9ST/AbSHw35xgQEe23zaEC+wdzYc4QMPxF/9smcdbu
+YyA0tVtO6PefoNAO5/nvNFjkEED7kwVu5X2K7Urn3w4lrZ7w5e4FhEoAukN6T4Va
+lAhg+uUtIHiM12B50/tZB4N30bFsP9eDAoIBAHc7ppfpo1aDK3bDr6zTSOU4Mn1l
+XrfhBJHDy2Wt9WkvWtcCtXr3sDpthaChueV+mGoKvfgWyzUoauO6HDDsRYriqaQB
+cXclVjyy+3atY32Opz9rnWefQkbgTOQ+oQgOzEFhxNS+11Omc6ZZ9s31N6TZi/Yz
+rgXzhGrr73DkV6uwiiwkvP8vJxg8AMWKorDIm1myr9wwlK5ogDKSku1DM/y1gvlt
+4EA39fqURyqxN9o5Yq+8K1+a/smjGx95M+P8Nke4bMs1+lb7bBXbMaVpC6DLqj8B
+eleOZ7adY2mS0CBuf0PNkJRNDwF1B5VDmGBJLubUtGLuUUoEyUbv66WfnUw=
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/ssl/registry-noca+client-cert.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE9DCCAt6gAwIBAgIQb58oJ+9SvWUCcYWA+L1oiTALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTUwMFoXDTE4MDUxMDIwNTUwMFowEzERMA8GA1UEChMIUXVpY2tUTFMwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDDmOL3EhBm4So3agPMmF0z1+/nPlrE
+xoG7x0HYPk5CP3PF3TNVk3ArBPkMzge0/895a4ZEb9j+LUQEjOZa/ZwuLmSjfJSt
+9xTXI1ldp8KasyzQZjC33/bUj7FGxGzgbHyJrGGBoH2W5HdswH4WzhCnGTslyiDo
+VN4hklJ7gr+Geq3TPf8Eji+1L71MOrUyoNp7BaQBQT/gKxK0nV+ZuSk6eaiu+om7
+slp3x4bc21o7eIMmNXggJP6p9fMDctnioKhAPcm+5ADiFYSjivLeUQ85VkMTpmdU
+yvq6ziK3Ls6erD+S3xLvcHYAaeu84qLd7qdPwkHMTQsDpO4vPMIwL8piMzZV+kwL
+Bq+5xk5//FwnQH0pSo2Nr4vRn+DITZc3GKyGUJQoOUgAdfGNskTt8GXa4IsHn5iw
+zr12vGaxb//GDm0RLHnh7NVbD8xxDHIJq+fJNFb7MdXa8v31PYebkWuaPhYt6HQC
+I/D81zwcJIOGfzNITS2ifM5tvMaUXireo4pLC2v2aSY6RrPq1owlB6jGFwGwZSAF
+O6rxSqWO1gLfhJLzqcw/NjWnO7nCZEs/iKgAa22K2CtTt3dDMTvSBYKdkRe/FYQC
+MCa7MFJSaH85pYRzoDN4IuVpvROrtuQmlI47oZzb64uCPoA4A8AN+k8iysqITsgK
+1m8ePPXhbu4YlwIDAQABozUwMzAOBgNVHQ8BAf8EBAMCAKAwEwYDVR0lBAwwCgYI
+KwYBBQUHAwIwDAYDVR0TAQH/BAIwADALBgkqhkiG9w0BAQsDggIBALSgrCdEQd3I
+vb/FNkNZkAwdjfBD6j7ZtPBwvjEiiyNTx9hOLBGvbey7kr0HtW0KkLWsdRmCc+3z
+ev9I5VjDOtpiqrvuAA1wRBaL3UzGyj/eFjPJpvkfJi8zjkIZ2y18QG3yJ6Eqy6dD
+0aIQAHl9hkXMOVrf364gf0p7EoOGtSlfQ56yIGDPTFKKiy+Al0S42p17lhI4coz9
+zGXE1/SiNeZgdsk4zHDqhzzBp8foZuSL1sGcIXHkG8RtqZ1WvCyIPYRyIjIKZcXd
+JCEM//EbgDzQ7VE/jm+hIlYfPjM7fmUzsfii+bIrp/0HGEU3HN++LsA6eQOwWPa/
+PrxKPP36EVXb72QK8C3lmz6y+CHhuuAm0C1b1qmYVEs4eRE21S8eB2l0KUlfOecf
+xZ1LWp1agKt6fGqRgcsR3/qO27l8W7hlbFNPeOTgr6NQQkEMRW5OxbnZ58ULXqr3
+gWh8Na3D4+3j53035UBBQUMmeeFfWCvtr5n0+6BTAi62Cwwu9QQQBM/2f9/9K+B7
+cW0xPYtczm+VwJL6/rDtNN9xPWitxab1dkZp2XcHG3VWtYvE2R2EtEoKvvCLPggx
+zcafsZfcD1wlvtQF7YjykGJnMa0SB0GBl9SQtvGc8PkP39yXHqXZhIoo3fp4qm9v
+RfbdpOr8p/Ks34ZqQPukFwpM1s/6aicF
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-noca+client-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAw5ji9xIQZuEqN2oDzJhdM9fv5z5axMaBu8dB2D5OQj9zxd0z
+VZNwKwT5DM4HtP/PeWuGRG/Y/i1EBIzmWv2cLi5ko3yUrfcU1yNZXafCmrMs0GYw
+t9/21I+xRsRs4Gx8iaxhgaB9luR3bMB+Fs4Qpxk7Jcog6FTeIZJSe4K/hnqt0z3/
+BI4vtS+9TDq1MqDaewWkAUE/4CsStJ1fmbkpOnmorvqJu7Jad8eG3NtaO3iDJjV4
+ICT+qfXzA3LZ4qCoQD3JvuQA4hWEo4ry3lEPOVZDE6ZnVMr6us4ity7Onqw/kt8S
+73B2AGnrvOKi3e6nT8JBzE0LA6TuLzzCMC/KYjM2VfpMCwavucZOf/xcJ0B9KUqN
+ja+L0Z/gyE2XNxishlCUKDlIAHXxjbJE7fBl2uCLB5+YsM69drxmsW//xg5tESx5
+4ezVWw/McQxyCavnyTRW+zHV2vL99T2Hm5Frmj4WLeh0AiPw/Nc8HCSDhn8zSE0t
+onzObbzGlF4q3qOKSwtr9mkmOkaz6taMJQeoxhcBsGUgBTuq8UqljtYC34SS86nM
+PzY1pzu5wmRLP4ioAGttitgrU7d3QzE70gWCnZEXvxWEAjAmuzBSUmh/OaWEc6Az
+eCLlab0Tq7bkJpSOO6Gc2+uLgj6AOAPADfpPIsrKiE7ICtZvHjz14W7uGJcCAwEA
+AQKCAgBmIvmxpp8l+cH/ub5OIenZXpMJn4fqZPXtxjjd4HshIN0ln0JlF15lOG2M
+gDGKFGKUts8gAX/ACocQETtgnDnn65XlwPIqfXFGflD2FNoLyjBGinY6LhtIF9is
+aXmpHz1Q7tDjzZiHKLor8cBlzCjp+MToEMpqR5bO1Qd5M2cro/gM7Lyz9kN3S3x/
+x9BCpbgwsVtYxGfEePmFkwAO159tx4WMCYvOlW2kSm5j+a7+iwmA9D7MGkVZHvNN
+A7Y/H0F8ekdVBN5pMG9Yrv/vk0ht2lugcS5YGr4eufFq0mhWdv+jhBTxLzqPMMBG
+m9oMJcj8XyXYtwpfVsqBpCqK2wnEnv4Kf0rZzBU706nI2mjPXx3dL+5qo8uQJKNp
+mxoS7vmHV5RIJgtdvyzGFHjdfu1leowhV+Jy9jWzMw4wlnmlxsfDECf5RoSf2XGt
+SMGJb0dbJKae+W4MfNUFsgAWMZk3h3KF8AHHe44OpDbQeoh3JLnkWSG0oS3CR0ch
+68TzCy0SZZEZ9IS+I6o5WVpwWfReCQ5NjaKipWcpiJvxg+Dc3GG3QcVXVz2gGrJh
+g9v0v6eyeOJ32QGvvP7THFBjpWeeHlXT8Yz6hFcPrvErEZ029TEmhg8aLWBGfsR5
+F1bazdbqvOSEB9vBAAaddNnEDG9Rl8EmC4WdsnVgYUw1J7gfQQKCAQEA9DKjD9eN
+CrUl/2YfSm2WaFhYci74XcHDVeAXN2SbOyKbMIqk3aOFQNRAsLRnwPkdiLtuqeDK
+BafrfLTCORHfFdYKnUzmuekESNLckN9VyLztgqOqNAv3LD6GmSHBaJEnUyniLxOL
+k0wMEBIsEQw7Fb4blM2REYJ3ZzMFmgpRGnIX8KcxhW9XgSrnqMLO0w6mVxjo7xzd
+813nCcNrGhySM/EzKYtTNHy2JZmMH5QFHaIj67KklO7VeEZX5U+TKveBEt4rmHqs
+Ndqf/djSs8vu1xse82pVRxMXX2mhDLmwjUjPgWYxUL92jTiyJhE7GxpVB/yHgF1J
+Ecb47MDahoNKkQKCAQEAzQzvCOA77IQpGO117GcMqcjzwEUhTytojFBT+s5mHfzk
+dYr5TyN86LQ7/GktNoJ5oRvD9UGRSul1OGneivqtWj6mv6/Zvfzacx8NXY4MYFs1
+nEr3Gr7orVFIzD2x7nMPG2G6+J6hZ1rhpnZ9Hprf5G41sHIJxHJ9wTYSUAmFh8bv
+FiJqF90bSq/E5hgjphtX6wZWeZYspzc/5+IrJ/I0nqoxV3rjUy234zlzKJAV10sV
+5oVgxLLQsUujkHp/Da+ij2aTv1Za8y3PTJ7MAHYgdpa5l/4U9MnPUEB2REBCI1NN
+TqxnViwD0xgsvxfb79UzruLJIYOCKvfOumlutXM0pwKCAQBUIMXQhWAP2kyW6mXJ
+TGvO0vDVlZz3H/Pdt/AHo19fRhLU7E7UFKupo/YNanl8H9au7nO3jrvKqwkT02o+
+IwwKB81sV7v9PGu/cvWN64MwPvZMVXojqCOlWH0icGCjV66Glh1YPpGNU1ushbYs
+wVvxp6b04sUhlSLxqMA7S2aZh8j7nX4QDEXHODLLDyIV0Cw6QViuV/GXEDiyQmK5
+gjJUNrp7i4ZExNozpeyCTIpepSde4hKVRJrCbumFFJ8M5GvRRj0asNh3TTRlTbd5
+Pb6w2KUXEwECFW+t7UQQkEBkzDrAx6YhvXRoPqoRN0p3keDNeZBtBrZPq47CccZX
+JRAhAoIBAQCJ/DgnGu54XP9i/PksGrSU1Nvi+SJPKoDyW2QIFTj22SXMS7c1oEYA
+OrlbRFPeqLK8zfhyZKsnZC8zxVqy37okTqDbwbSfezZt3emamWqOtRJAmNnsr6fY
+aii4+JNySQ9Td9LgV69549iRso7EN6iPCfMrR7J29izWBlMQdTfchOyDUqleYbZp
+7hpsVLY4o5HoYJ10uLBX3oAsxTARc5YhZ5pIqjOr18o1KIXsN/napXaZaAwUkdiK
+VsI9CZHSXezg30Bxs+UEXEFx6DKT5Oo3o3pFZAAqMlxGPvrXNv7K0tXlKXNos7nn
+Jg+GkMG6hRiAibCb0umXjKcbHrQXeu1lAoIBAQDcRBsy6cSQXMSu6+PyroH+2DvR
+4fuiMfSrUNjv+9K8gtjYLetrZUvRuFT3A/KzDrALKyTFTGJk3YlpTaC5iNKd+QK8
+6RBJRYeYV16fpX/2ak/8MgfB2gdW//pE0eFjw+qakcUXmo957m7dUXbOrw1VNAET
+LVBeVnml+2FUj0sTXGwHKcINPR78PWZ8i1ka9DptnKLBNeA+x+OMkCA88RJJegSk
+/rgDDV52z4fJHQJh9TZ7zLAXxGgDFYLGPTrdeT+D/owuPXF+SCP4pMtVnwbQgH9G
+dfQ9bb7G14vAeu/kEkFdGFEreS09BOTRbTfzFjFdDvSV4JyOXe9i/sUDxf9R
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/ssl/registry-noca+localhost-cert.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIFCTCCAvOgAwIBAgIQPjclBRGzhznCybQzYRQTyjALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTQ1NloXDTE4MDUxMDIwNTQ1NlowJzERMA8GA1UEChMIUXVpY2tUTFMxEjAQBgNV
+BAMTCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALBe
+C9O6es+mStDowUd1kiM59VkinzzdHgE24LvKmGxQ6fDnnT8S9L7iyzoxcJWlvSHu
+pfyZWvij0ZIyRZ288XemTEFYq25RK0IBGGdvYz9OqT2R3lblBQrXDjSi9WG16sGx
+60MGhM2egGMqFQ5DBfT16IKw00+RjFgCVzJ8T64Lzw82E0e7d6hl39SPybY+uvrt
+SID60hYGmXoOdaiC9qquivks67BZprGNfORrvyJNrCFI6oKUFWHrQ1PpGd2tOwJN
+1P3gkkS8pVlAif6ZQkAf+zuKu+l4j5tKxGlJAkJsafVJDLOxBKutUj5msha0g6uJ
+gFXUe0+G8hkNcEjd8XqUUCwIOY3pdv4WsydKBk3uH9zMnYolw53k1q0ObvoY1NXf
+beMxHQAtDi7nfQGlae9cuuOSymy95WuvzfhZFKdPWUe8lKN9QXFIWVoCFnOm8T3P
++FNCUE+p8DIWkal6Ul9THi/Kz4p7twyrUp1LwT5EtSaJ3iGAmB9I+8/1vmZT3lPi
+nX8P+iVGM5yOUnptrsFm0bUcJWRD6iaTK1KxpH+Is4h2kiUiSz1tC/9bKaJYN2o9
+oy7q7+ZVfHSmIxLo8ZFYsaZBcXi96cKuuPMR3X4ISPwKDqP5irxU/QbI+YQBMshg
+G4b0BNoMZ50g30r3Hcsifw4pzPQF0RDMOBeCiOi3AgMBAAGjNjA0MA4GA1UdDwEB
+/wQEAwIAoDAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDALBgkq
+hkiG9w0BAQsDggIBAFuS/VrMNUwEMyUIktDyna5ExYh/FDOE+YEYf8tsX7dSMhRK
+wE560/AcVZcbKKAZOnZ/262a++8tparsQt+bXBJ2so6YUqsFDNdOLCI2aShjWDRe
+TNhqmLIO3FNsLRKp96WHVz+jFoiECsoYfKn0jgqTqxx+7nWFqgBaNSlF5cbCgLCH
+jQV1uQhzsw/Mh/32hXAidkv/nLeLf7FbKq08hgthtoP+XstlzZ5BxkPodjb8XWXG
+DSS49SWX971GHa1apwMKfxVGSppxn18ZwEmW1BUfQBNxtMytqA9DK3+xuoUdXkB0
+iJbm3Jc10JSRju8iyL121Xt6f8O33paVz/ndDJIWztUOjnItc89rxHsINPt5+cUt
+jix8ohwmHGDrK7ZooXBvotvmGT/xhPr2eHUAG8JuSJ/Cr09UUOwUEigz4CfgJOHm
+XukdzjOkb4r7lhNmVeGqrjRol1W0Wsc1NGH++J6xdkIeQ+i23kHwFHfQWV/J69tm
+rOn2N+qijtmbIy9YfVcrFDtUtEAzXylZ2StCVQNofd0M7tXNdrUL8yAFwlrhWGJV
+wsSP++1xH2Ie6Diupy8z6rbP383HmnmVPU/UecgLrlX2lEpt/UZkkX1Xm+6PhrrT
+HDeeULvqtUP3PD8wS0C873Pl9GXOKISqf0HKEIDUAVZhQOsGFqiZH0388M4L
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-noca+localhost-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKgIBAAKCAgEAsF4L07p6z6ZK0OjBR3WSIzn1WSKfPN0eATbgu8qYbFDp8Oed
+PxL0vuLLOjFwlaW9Ie6l/Jla+KPRkjJFnbzxd6ZMQVirblErQgEYZ29jP06pPZHe
+VuUFCtcONKL1YbXqwbHrQwaEzZ6AYyoVDkMF9PXogrDTT5GMWAJXMnxPrgvPDzYT
+R7t3qGXf1I/Jtj66+u1IgPrSFgaZeg51qIL2qq6K+SzrsFmmsY185Gu/Ik2sIUjq
+gpQVYetDU+kZ3a07Ak3U/eCSRLylWUCJ/plCQB/7O4q76XiPm0rEaUkCQmxp9UkM
+s7EEq61SPmayFrSDq4mAVdR7T4byGQ1wSN3xepRQLAg5jel2/hazJ0oGTe4f3Myd
+iiXDneTWrQ5u+hjU1d9t4zEdAC0OLud9AaVp71y645LKbL3la6/N+FkUp09ZR7yU
+o31BcUhZWgIWc6bxPc/4U0JQT6nwMhaRqXpSX1MeL8rPinu3DKtSnUvBPkS1Jone
+IYCYH0j7z/W+ZlPeU+Kdfw/6JUYznI5Sem2uwWbRtRwlZEPqJpMrUrGkf4iziHaS
+JSJLPW0L/1spolg3aj2jLurv5lV8dKYjEujxkVixpkFxeL3pwq648xHdfghI/AoO
+o/mKvFT9Bsj5hAEyyGAbhvQE2gxnnSDfSvcdyyJ/DinM9AXREMw4F4KI6LcCAwEA
+AQKCAgEAnrHg/oD7ZMEC7PuifoRCHMRYCf5nPkLQbtNMYG2pvT0JY6VlDo4l/2Te
+7NvzrBPYHSI55RKwkq4FMwFdNtP+imTulJYOm1MaE2gc52WI7jv/eNE6OQIWCWz8
+8Uv4dBVWyTcos8S31rTaXWBOVejlAUgMERy+5wfWOpLQlzLYF4m0pMFJk/AReUtB
+nmhLXlsPsB22cag/RWZmzzcXk6tT/LzVe+R5ptLkdTsUuAxjjaBKVCDiMuDAZL1m
+dah3h8oKIMab8l0SABumxKqYAKkyvbSJQUhSUYAT5+3c0cfJ6q7WoMk8TqvnwfpQ
+2Klbcaa4G6+79H8e/a41RWmcMVTTpLKmwzx/iMLPswLnTFbWYCsLSsml3OpmXPhG
+CKdbIWMvNMBfahZmnCP2pNcZBVY1/k/lEw25ehtnWqA7HplawT6V3gk/Bzz+3e3R
+XEpioZF70ipdW5Pb3OG/tKSNDvRRjqLPk9UWlQzmedzu7XN28V/blw/CBVcMAcc0
+njwAledTuqv/wQ67dtbXdcxSPZbV/Rq7y3OmpgK6RWLIFzzpOPW5gULqUZfrnxtv
+StxVnlZXhFoymodFobTi7AYibsLaXLkunZWXEwFwdtLfFHznfHq/rHfBmna1lcKW
+MgWRqsbaoCsqHC1nc0E4llFkn3zqGYgMQNBeqNfX6cIPI/eQzPECggEBAOk0TP8N
+edIFENOrzUtpH1fB3k15heeA84SeBhj8t/xrphR3o+IVO/GtMtq9hVLeYFVPwWCi
+Mmy4KhwNUOtFeCSX4MbpiXvoPEjL3QF+Sv95HsEWsT1iBQIN4aoV0ZSv48YsRczs
+tLjr96hADLTMfpCwyRq9r8XVF/hnx7vqOoOC/J1kteRhjOWRnutFpdAMfkFgzUa9
+1unmDHsDifcT+vpxief9Q9zK9xMYvYmwFkBUjOlhC7WchZC20nrwvM+A2mMBpeLB
+WSRWsYeOqW8zcQNGdWuXXMKxsYHwv9tXbANVWxs1gz4x7BxcFoN5poIFrnT+eImY
+EwhGrKR6jZsKF00CggEBAMGbdZU0+yvxL2tAul5RGAqv9xhdUV4eg8warTQ8/RWt
+8Vef2wllBYnP48rXNDovb7ZNOjMBdjIWZ2zq2McMtHqpzP+zWQWaNT8/7Zi24JTL
+y4G75kZdGgTPG2Y71seZoZGxfOu4gf7cLKOqxiHYrNDHEDl5Pi13tJD/8qf6hYm6
+K3yALSv+QlM3mk+5oueKQ7Lj9rV81YomYSV5+K+WhszhvLmuxv0necOLKapeBWvL
+GQ5038yAq3PFdu0HXzyA6L8YdusP1d3sqwQvLbi8KAMXJCeT6WZXGYgX2Rjfbuih
+ZHUaE7Ac0EsJfMuOowSkS7oXuT81k64ngCoq5KZC5hMCggEBAKYkt9JiZG8HYuSb
+GsjmHQllup5RvN+hVF0gRFHbAq2YeBtO3Xg+DpXxAjErIuhWPCWri6bwB6LDVmTj
+68milaTke6TbTzLy0rg+Xbcppf766LlCFIYZ5l1/TE3j+4vGAC347sW/wkWY/7lj
+4GmS43zsJmqhx6/XUJuOPJOZnZSCZr0vuhL6mOoZZDJUTXy62dx0PetvZsT/O9cM
+P2fDWWTCLTEVlBqik4KMdsS4qjGsyzOeCzyZReNDDRO/nZTsRSqSSwARJhQom5Rr
+RDVQXeyqbw93KAQhmshroBSB5Rc+4YiyCE3wPTo7NWL38XPi3lbF0VSd/rk/uNH5
+6hcSCmUCggEAIPHjQFCTrRaNiyKolAQYozjuQyceAXYP11tyvcDjEB1ZRB/flemq
+15iYmpukN4J67/qUPLmy8zL8xnvwB28SBw195MUQEPP8u5aVR7dW3/sN1jWzKaYO
+F2Nmti7YjX6HD9Oz/iiXdlbhAbi9nmTQg3ZcPGt1OSd1gncLQ6pNrvIPFFB7X1EU
+2DRN/eMI5X2Rp49DG/7yF2AQh+AJgVeL+LEw/CfRlKJzBeNYY7U8Fuuoh907eAEt
+K7YeVpc6jYEiGeJ/2eAH9IuhTkT48saRyHTXoiR5QwDvR0lHmAPtS4irH4Igd4dv
+qlUi90B+XPvYJwKCc08aojf2hzZlUiVwIQKCAQEAraCoWea8hLFchxmAiBt7joIg
+nNK7a3LOHYxT1gB9H+PoVqTmzGVTeZpD8Jnis/UHmDhRYuUGqvFIefjAWbz0jJAN
+t6RMAozENCG1PoeXHf1gt2wspv14kza+8jSdpzNrzZgPZdb7Wh1UEqUkiRYwn87f
+C7DHknqCj9S2qq0DFXYz15JNPVrbvD+ZLBFJhTAjppS9TuYQVLf8JPYHpLRio/9A
+dMsyOz1VA2RRYN0u/u4ccxiN45K3PbVMCeDPbWXNm8G75YKQ7LnIuehMB1qkZy6N
+MOnNGp3l/ZkFK0JsW/pZqTQ2FqSkb0+ttTFApFI3qB04sc4s0uKPI9fa0OQtUw==
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/ssl/registry-noca+localregistry-cert.pem

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFETCCAvugAwIBAgIQCnqSQalw9ytL5bHLgHZe+jALBgkqhkiG9w0BAQswJjER
+MA8GA1UEChMIUXVpY2tUTFMxETAPBgNVBAMTCFF1aWNrVExTMB4XDTE1MDUyNjIw
+NTQ1OFoXDTE4MDUxMDIwNTQ1OFowKzERMA8GA1UEChMIUXVpY2tUTFMxFjAUBgNV
+BAMTDWxvY2FscmVnaXN0cnkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+AQC9gvT3cwz0Ih9+7Ilv5lc15HsEiSmEMh4nOMZrSaamKgf/ydCiGo3DQapr/XDK
+FHMLKq68AxwfOlzmEFQ4d9umpPMQ2+4GBr0VG23ppGtQApIPHgD06S0/CeHmDIXN
+FXcKybPX/9KbgNkXBWbbJkJy0EcsdP8VJD50Q2WH89nvgEYJNFuKEELD3iGY6bBF
+jeDTle5jYA7CgBKvD2avn31g24Qhxn8n8/BdYO/U0kw0qmoy1veLOjCAW0os0jkM
+NlKrFpyHEWNj5B3X6UgSn8EGQaVbDq17PrQwlHJYU4nih0TnD1OwvBnFnd27pXjr
+68eGA6Zc2BbUnhNGhppWHZ46LpPxpIbafSOH3ES3N/MZAfcUKIUntLlWE2xCQgFV
+TW95WeVtP/r1aWgIHu0E2Jb2eHCE+qXYqJxSU7S4DcknmmcTS69hzyHs+92Ec+7Q
+m0aQFZ0dyPoYPwXMgZpTAIuXEGg/FKC1fiS/deTW37DyvB2jppehKW3RJY3uso7R
+o9vs6DJx1OdU5XEq9R3n7op61N7PK8Wxmn7TVYHEZHkITVvtucZZd1FNTOrOJaNJ
+UnE+FuPK1Mrff+jz666Ru4zQL0CondOamX3QR5tuNK6MTqFs87wKY25qsqz7cS27
+kHW+r7UNWbJY3/UQhaPZM78zCZa2IL1nBFUjsFvEA4rtYwIDAQABozowODAOBgNV
+HQ8BAf8EBAMCAKAwDAYDVR0TAQH/BAIwADAYBgNVHREEETAPgg1sb2NhbHJlZ2lz
+dHJ5MAsGCSqGSIb3DQEBCwOCAgEAHVGMyoyX4lRzWCDkUjrXkrDZzuv03M2ojW2Q
+UL61ejMkTWQW8R4gKrcPHAOJAPKVfGEVOrQH3ZMyxV2HnWrJ7egrn65zOzmLbWSh
+O7gdpL6YYjBr218fqJn/8HadXZa4k70JyympYOLojeWSLy3KP03U+y7AMcdE1uG6
+6HJI54ZjBoW/nEyWmMh/mfMz8EN+Mgek48Z9AVaOswbtHtDIXN7XO0jbB3DbY5Yh
+prVqVLYAz4sCchGTadj+aEChF5sJkKREDvAew/njC0WGS2TmMJ+V1uVhXV6354mr
+edk79YvdwzwDgeYArkprahMtn9eu1aSTfUXsmM5OP5tR4gyFV1kUmTPY1yUd/yO+
+638wV0mWtGbbf6j8dUKeUBCyt2qGg8J80OUeFdvdHMswtaUq951NApX44BinPkbK
+moBVQByZ5OEcmMidFC9SqYSUwTQ7uNyWeguhCXav+l3x900YlKnUQgRUZntPwXjs
+yc7MXv0j0E86Gme6G1O02zamwkRgr3qOTHu2oQOow/a24fM4HASayLR0Kegt0sh3
+rzk0HRF1mGonf1Ecyyj/3LpHVsgYSckwtJoZLOqtDMn+CKtOCEByssQfD+E9Qe07
+qMyvcwpXUpfqe3ZERbJ10m98Z88VeK/XGt9ptq7HY47n1KL6lx3oyXwZIw8pq928
+89dcqL0=
+-----END CERTIFICATE-----

contrib/docker-integration/nginx/ssl/registry-noca+localregistry-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAvYL093MM9CIffuyJb+ZXNeR7BIkphDIeJzjGa0mmpioH/8nQ
+ohqNw0Gqa/1wyhRzCyquvAMcHzpc5hBUOHfbpqTzENvuBga9FRtt6aRrUAKSDx4A
+9OktPwnh5gyFzRV3Csmz1//Sm4DZFwVm2yZCctBHLHT/FSQ+dENlh/PZ74BGCTRb
+ihBCw94hmOmwRY3g05XuY2AOwoASrw9mr599YNuEIcZ/J/PwXWDv1NJMNKpqMtb3
+izowgFtKLNI5DDZSqxachxFjY+Qd1+lIEp/BBkGlWw6tez60MJRyWFOJ4odE5w9T
+sLwZxZ3du6V46+vHhgOmXNgW1J4TRoaaVh2eOi6T8aSG2n0jh9xEtzfzGQH3FCiF
+J7S5VhNsQkIBVU1veVnlbT/69WloCB7tBNiW9nhwhPql2KicUlO0uA3JJ5pnE0uv
+Yc8h7PvdhHPu0JtGkBWdHcj6GD8FzIGaUwCLlxBoPxSgtX4kv3Xk1t+w8rwdo6aX
+oSlt0SWN7rKO0aPb7OgycdTnVOVxKvUd5+6KetTezyvFsZp+01WBxGR5CE1b7bnG
+WXdRTUzqziWjSVJxPhbjytTK33/o8+uukbuM0C9AqJ3Tmpl90EebbjSujE6hbPO8
+CmNuarKs+3Etu5B1vq+1DVmyWN/1EIWj2TO/MwmWtiC9ZwRVI7BbxAOK7WMCAwEA
+AQKCAgEArwqno2uEGnbuKnjmVRInmWKpcb4TN8Rm74lUVEKaB76o1s0cxK3MJP6h
+H8/e/vg2bqkE7indLsbkiaepcuLaYijXTcomJzDQMw+7zOOOLz/Aku/+qDg8D47c
+NXV5nLzn0HIPiEIF0JYJbmcR4veKxqu0Ic8K0QdCHHcn75P/x2Tuy4+twW9Vi76/
+v5KRuxzZ/fTtVKKj32kWWNXb3fltgCoh+GR0jH2XlVh1DVkVBEwnfT/rM5ESvWwU
+riOah7ohT1+6QlOAPwKzwfr6FCG000eNKPb8q+p12q0ylHzMzgxtSxJwFb0X/Nzc
+snaboyWLjDAQ2I7LP6WmXizznvkKbE9PjW6UGYQ+2XApqp+Hn8tSC5I/gIDlBOOa
+psJ4fkRjr8n5+CbHbGmQG736hZcZY/z10TtOQbxeeeuri6oDQ62D4Z07GpWCG2EG
+sUakaytZnJkIN79PpfthPZwtStlG0KVs0i5wggH/iP2h0yAmvJ64ZRIqdvuE/aBn
+sdfRRlYUqmFOJsVQgtUWGKGS4WIxrGaclzT1TNxCKdiAk0glXe3sDtvBni6qDW07
+iJzEXxrsLw6MiCDhHfDeae5JYeJXK0HlCfYHXgRmEnDFTGw8rBzwz3eXvPqZ5YNt
+j+31uHSwQjgOgEgSrXeTmRfLZsytKqndhBB/yBFmzZNrswXGackCggEBAMN5RSdW
+t+WWl8ghDGz/CN1oRjnk298/6L7ijluKGRgG+igwBEy+5m1EGPJT+Y5LEH4TiQJe
+Oc2XjQuM7zABX7JWWk1cL8Zlv3kcmR0lg4BWs7wDkoU1HYRkMP57vubtxFzFOsNa
+momivEniZ/eonHm3yv0VHeenH9j3mhJ3mVDIpkH+7uhn3++c0zYh96NkjfQi1/jF
+P35eSAt7FgHDOt37fWXwtGeYFRN4P19ZUNiIvZwT6Q1gmegRO8BYoW6cSbLWe5Cp
+abaULds46+mjM4zJhCZRFkdWHbzP4bZHocSmwGsqcpABJ6SASTVim02GGhBIt1nj
+fkqa10X1c5Sqis0CggEBAPgxFKSHccfIJ6yht2HJjysRLN/IHlO9hDcpCWUrISN/
+hxu1uxfNGmUkd0H8zDO/O+QAJXLE8PPPB77pJniIJ8kK4swwsfufN6bNV9XJldjA
+o4vXnYt9Mpuky9cugD8LocUgWQzzKY5Y875TC4s3ldzyKQVm0NO+Wz1U3gfjogEC
+d7PhTk7Ba/ZjVGtL7HuZxlL+/TgZklMks2ulSTW2y8aqVJxaZXv0H0NX/+fpDHYw
+iljr+iqbiqZvjrzySryb0XWMtzP9oyDEXTXrWnG+kOIZW3BZ9FLxT+Te7zZ2PUbK
+vTkObsKxc8WVHIYgkt/OwWSwbYLre5nvFPvgEFbQuO8CggEAeZTlUXmbul63m5AK
+xYS/w88G1x2lMK/0mT4bY4562zoDwJlVI1MdydqwVZGryDiiUnjeIC3xcBISdZu8
+bjR8jFUvp6xuPs2ska0bA0kBCQNkmc3zBY2rBVy4KKFZdRNwrm8yhK3HL1KcIKyF
+FEK4yPBrfozy49JMecxP9aqUHu4eky/4828gl04JBUONXwC9VpuRj7dILdaAozt0
+zbXb2JSDQ7O60jCC83A4oprQMU6j+P9dVqe+Mtz9OD8ocb8eC/FiO/FTwm9aMl+u
+RMzw1GHHI3oODGLg7j6y2oilcsZxKnblePJu8N+mKWFizY5aicRg3rUkKU00Ftx7
+fn2xBQKCAQB7w7Xgie5SStyF+KrC58kuF8WB3oBJEAOjoiIeQhCnbAvK5KfkqZHV
+CAc0b8TAtUc/XldOUSk6222oZQmbJ4J3fac1Xb8TlAUjd9iqMnk3+nBT5vSYP5mC
+Bf7kUjr/tWQ5MfVWQNfjNTZvHWhvRwvDfzq3h9rxDEbhYbXKx1fdGwboO51aJpgY
+6NWLH/RQepFsh91sIUxXi8CxGF5Wm84oRn4k7esXkdgZNAPX+N4O/guvZhV9M81D
+S/QpAsYEIcuky8P7+Cplx6YXokKa4AXNyglQEHuG9PD7V7SAOxw5dhZAIpNXIThz
+OfVcaVf0pVzJQjWKCLW9QHz9UXG0aScfAoIBACdr3exVMUaMOtrAnf2NXj3hecgg
+WsWRBOOaSW5wXGt1JNlfYS4zwViafIwy31DNuMg22rj5Mq0TYMtuNYto5RoLSXeB
+uupUrENEBnt7JFrwI/NyWG0uYMM3G2MtGHGYooaT9+++wT96QxJZr5fwFYF1ddf6
+5tFeKtNt5VM0wWBHO1voUhQ0TCaooatJjMuAB0+WbvwniKxmdbqQDzY+6myBBUVo
+gBJ0JxhxakLm1XGFHDtPCsAAHX/uZ4CvH2uyWqAlx6iwGXd0wwEGrbIRB/BundxR
+oaJWswU4FIPAgOpy2LEJKnvzhcmVFtZWD5sFXA1/83QvpceLTFTD5uioBPU=
+-----END RSA PRIVATE KEY-----

contrib/docker-integration/nginx/test.passwd

@@ -0,0 +1 @@
+testuser:$apr1$YmLhHjm6$AjP4z8J1WgcUNxU8J4ue5.

contrib/docker-integration/run.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -e
+set -x
+
+cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
+
+source helpers.bash
+
+# Root directory of Distribution
+DISTRIBUTION_ROOT=$(cd ../..; pwd -P)
+
+volumeMount=""
+if [ "$DOCKER_VOLUME" != "" ]; then
+	volumeMount="-v ${DOCKER_VOLUME}:/var/lib/docker"
+fi
+
+dockerMount=""
+if [ "$DOCKER_BINARY" != "" ]; then
+	dockerMount="-v ${DOCKER_BINARY}:/usr/local/bin/docker"
+else
+	DOCKER_BINARY=docker
+fi
+
+# Image containing the integration tests environment.
+INTEGRATION_IMAGE=${INTEGRATION_IMAGE:-distribution/docker-integration}
+
+if [ "$1" == "-d" ]; then
+	start_daemon
+	shift
+fi
+
+TESTS=${@:-.}
+
+# Make sure we upgrade the integration environment.
+docker pull $INTEGRATION_IMAGE
+
+# Start a Docker engine inside a docker container
+ID=$(docker run -d -it --privileged $volumeMount $dockerMount \
+	-v ${DISTRIBUTION_ROOT}:/go/src/github.com/docker/distribution \
+	-e "DOCKER_GRAPHDRIVER=$DOCKER_GRAPHDRIVER" \
+	${INTEGRATION_IMAGE} \
+	./run_engine.sh)
+
+# Stop container on exit
+trap "docker rm -f -v $ID" EXIT
+
+
+# Wait for it to become reachable.
+tries=10
+until docker exec "$ID" docker version &> /dev/null; do
+	(( tries-- ))
+	if [ $tries -le 0 ]; then
+		echo >&2 "error: daemon failed to start"
+		exit 1
+	fi
+	sleep 1
+done
+
+# If no volume is specified, transfer images into the container from
+# the outer docker instance
+if [ "$DOCKER_VOLUME" == "" ]; then
+	# Make sure we have images outside the container, to transfer to the container.
+	# Not much will happen here if the images are already present.
+	docker-compose pull
+	docker-compose build
+
+	# Transfer images to the inner container.
+	for image in "$INTEGRATION_IMAGE" registry:0.9.1 dockerintegration_nginx dockerintegration_registryv2; do
+		docker save "$image" | docker exec -i "$ID" docker load
+	done
+fi
+
+# Run the tests.
+docker exec -it "$ID" sh -c "./test_runner.sh $TESTS"
+

contrib/docker-integration/run_engine.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+set -x
+
+DOCKER_GRAPHDRIVER=${DOCKER_GRAPHDRIVER:-overlay}
+EXEC_DRIVER=${EXEC_DRIVER:-native}
+
+# Set IP address in /etc/hosts for localregistry
+IP=$(ifconfig eth0|grep "inet addr:"| cut -d: -f2 | awk '{ print $1}')
+echo "$IP localregistry" >> /etc/hosts
+
+sh install_certs.sh localregistry
+
+DOCKER_VERSION=$(docker --version | cut -d ' ' -f3 | cut -d ',' -f1)
+major=$(echo "$DOCKER_VERSION"| cut -d '.' -f1)
+minor=$(echo "$DOCKER_VERSION"| cut -d '.' -f2)
+
+daemonOpts="daemon"
+if [ $major -le 1 ] && [ $minor -lt 9 ]; then
+	daemonOpts="--daemon"
+fi
+
+docker $daemonOpts --log-level=debug --storage-driver="$DOCKER_GRAPHDRIVER"

contrib/docker-integration/run_multiversion.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+# Run the integration tests with multiple versions of the Docker engine
+
+set -e
+set -x
+
+source helpers.bash
+
+if [ `uname` = "Linux" ]; then
+	tmpdir_template="$TMPDIR/docker-versions.XXXXX"
+else
+	# /tmp isn't available for mounting in boot2docker
+	tmpdir_template="`pwd`/../../../docker-versions.XXXXX"
+fi
+
+tmpdir=`mktemp -d "$tmpdir_template"`
+trap "rm -rf $tmpdir" EXIT
+
+if [ "$1" == "-d" ]; then
+	start_daemon
+fi
+
+# Released versions
+
+versions="1.6.1 1.7.1 1.8.3 1.9.1"
+
+for v in $versions; do
+	echo "Extracting Docker $v from dind image"
+	binpath="$tmpdir/docker-$v/docker"
+	ID=$(docker create dockerswarm/dind:$v)
+	docker cp "$ID:/usr/local/bin/docker" "$tmpdir/docker-$v"
+
+	echo "Running tests with Docker $v"
+	DOCKER_BINARY="$binpath" DOCKER_VOLUME="$DOCKER_VOLUME" DOCKER_GRAPHDRIVER="$DOCKER_GRAPHDRIVER" ./run.sh
+
+	# Cleanup.
+	docker rm -f "$ID"
+done
+
+# Latest experimental version
+
+echo "Extracting Docker master from dind image"
+binpath="$tmpdir/docker-master/docker"
+docker pull dockerswarm/dind-master
+ID=$(docker create dockerswarm/dind-master)
+docker cp "$ID:/usr/local/bin/docker" "$tmpdir/docker-master"
+
+echo "Running tests with Docker master"
+DOCKER_BINARY="$binpath" DOCKER_VOLUME="$DOCKER_VOLUME" ./run.sh
+
+# Cleanup.
+docker rm -f "$ID"

contrib/docker-integration/test_runner.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
+
+TESTS=${@:-.}
+
+function execute() {
+	>&2 echo "++ $@"
+	eval "$@"
+}
+
+execute time docker-compose build
+
+execute docker-compose up -d
+
+# Run the tests.
+execute time bats -p $TESTS

contrib/docker-integration/tls.bats

@@ -0,0 +1,102 @@
+# Registry host name, should be set to non-localhost address and match
+# DNS name in nginx/ssl certificates and what is installed in /etc/docker/cert.d
+hostname="localregistry"
+
+image="hello-world:latest"
+
+# Login information, should match values in nginx/test.passwd
+user="testuser"
+password="passpassword"
+email="distribution@docker.com"
+
+function setup() {
+	docker pull $image
+}
+
+# skip basic auth tests with Docker 1.6, where they don't pass due to
+# certificate issues
+function basic_auth_version_check() {
+	run sh -c 'docker version | fgrep -q "Client version: 1.6."'
+	if [ "$status" -eq 0 ]; then
+		skip "Basic auth tests don't support 1.6.x"
+	fi
+}
+
+# has_digest enforces the last output line is "Digest: sha256:..."
+# the input is the name of the array containing the output lines
+function has_digest() {
+	filtered=$(echo "$1" |sed -rn '/[dD]igest\: sha(256|384|512)/ p')
+	[ "$filtered" != "" ]
+}
+
+function login() {
+	run docker login -u $user -p $password -e $email $1
+	[ "$status" -eq 0 ]
+	# First line is WARNING about credential save
+	[ "${lines[1]}" = "Login Succeeded" ]
+}
+
+@test "Test valid certificates" {
+	docker tag -f $image $hostname:5440/$image
+	run docker push $hostname:5440/$image
+	[ "$status" -eq 0 ]
+	has_digest "$output"
+}
+
+@test "Test basic auth" {
+	basic_auth_version_check
+	login $hostname:5441
+	docker tag -f $image $hostname:5441/$image
+	run docker push $hostname:5441/$image
+	[ "$status" -eq 0 ]
+	has_digest "$output"
+}
+
+@test "Test TLS client auth" {
+	docker tag -f $image $hostname:5442/$image
+	run docker push $hostname:5442/$image
+	[ "$status" -eq 0 ]
+	has_digest "$output"
+}
+
+@test "Test TLS client with invalid certificate authority fails" {
+	docker tag -f $image $hostname:5443/$image
+	run docker push $hostname:5443/$image
+	[ "$status" -ne 0 ]
+}
+
+@test "Test basic auth with TLS client auth" {
+	basic_auth_version_check
+	login $hostname:5444
+	docker tag -f $image $hostname:5444/$image
+	run docker push $hostname:5444/$image
+	[ "$status" -eq 0 ]
+	has_digest "$output"
+}
+
+@test "Test unknown certificate authority fails" {
+	docker tag -f $image $hostname:5445/$image
+	run docker push $hostname:5445/$image
+	[ "$status" -ne 0 ]
+}
+
+@test "Test basic auth with unknown certificate authority fails" {
+	run login $hostname:5446
+	[ "$status" -ne 0 ]
+	docker tag -f $image $hostname:5446/$image
+	run docker push $hostname:5446/$image
+	[ "$status" -ne 0 ]
+}
+
+@test "Test TLS client auth to server with unknown certificate authority fails" {
+	docker tag -f $image $hostname:5447/$image
+	run docker push $hostname:5447/$image
+	[ "$status" -ne 0 ]
+}
+
+@test "Test failure to connect to server fails to fallback to SSLv3" {
+	docker tag -f $image $hostname:5448/$image
+	run docker push $hostname:5448/$image
+	[ "$status" -ne 0 ]
+}
+