Upgrade dependency to go-containerregistry third-party library

By doing so it will fix issues met when mixing source/remote registry Close #808
2026-10-22 07:04:59 +02:00 · 2020-01-26 18:55:52 +01:00
parent e8fffda7cb
commit 03b8922ede
1160 changed files with 107253 additions and 38471 deletions
@@ -0,0 +1,16 @@
+{
+  "Vendor": true,
+  "Deadline": "2m",
+  "Sort": ["linter", "severity", "path", "line"],
+  "EnableGC": true,
+  "Enable": [
+    "structcheck",
+    "staticcheck",
+    "unconvert",
+
+    "gofmt",
+    "goimports",
+    "golint",
+    "vet"
+  ]
+}
@@ -1,9 +1,9 @@
-Stephen J Day <stephen.day@docker.com>  Stephen Day <stevvooe@users.noreply.github.com>
-Stephen J Day <stephen.day@docker.com>  Stephen Day <stevvooe@gmail.com>
-Olivier Gambier <olivier@docker.com>    Olivier Gambier <dmp42@users.noreply.github.com>
-Brian Bland <brian.bland@docker.com>    Brian Bland <r4nd0m1n4t0r@gmail.com>
+Stephen J Day <stephen.day@docker.com> Stephen Day <stevvooe@users.noreply.github.com>
+Stephen J Day <stephen.day@docker.com> Stephen Day <stevvooe@gmail.com>
+Olivier Gambier <olivier@docker.com> Olivier Gambier <dmp42@users.noreply.github.com>
+Brian Bland <brian.bland@docker.com> Brian Bland <r4nd0m1n4t0r@gmail.com>
 Brian Bland <brian.bland@docker.com> Brian Bland <brian.t.bland@gmail.com>
-Josh Hawn <josh.hawn@docker.com>        Josh Hawn <jlhawn@berkeley.edu>
+Josh Hawn <josh.hawn@docker.com> Josh Hawn <jlhawn@berkeley.edu>
 Richard Scothern <richard.scothern@docker.com> Richard <richard.scothern@gmail.com>
 Richard Scothern <richard.scothern@docker.com> Richard Scothern <richard.scothern@gmail.com>
 Andrew Meredith <andymeredith@gmail.com> Andrew Meredith <kendru@users.noreply.github.com>
@@ -16,3 +16,17 @@ davidli <wenquan.li@hp.com> davidli <wenquan.li@hpe.com>
 Omer Cohen <git@omer.io> Omer Cohen <git@omerc.net>
 Eric Yang <windfarer@gmail.com> Eric Yang <Windfarer@users.noreply.github.com>
 Nikita Tarasov <nikita@mygento.ru> Nikita <luckyraul@users.noreply.github.com>
+Yu Wang <yuwa@microsoft.com> yuwaMSFT2 <yuwa@microsoft.com>
+Yu Wang <yuwa@microsoft.com> Yu Wang (UC) <yuwa@microsoft.com>
+Olivier Gambier <olivier@docker.com> dmp <dmp@loaner.local>
+Olivier Gambier <olivier@docker.com> Olivier <o+github@gambier.email>
+Olivier Gambier <olivier@docker.com> Olivier <dmp42@users.noreply.github.com>
+Elsan Li 李楠 <elsanli@tencent.com> elsanli(李楠) <elsanli@tencent.com>
+Rui Cao <ruicao@alauda.io> ruicao <ruicao@alauda.io>
+Gwendolynne Barr <gwendolynne.barr@docker.com> gbarr01 <gwendolynne.barr@docker.com>
+Haibing Zhou 周海兵 <zhouhaibing089@gmail.com> zhouhaibing089 <zhouhaibing089@gmail.com>
+Feng Honglin <tifayuki@gmail.com> tifayuki <tifayuki@gmail.com>
+Helen Xie <xieyulin821@harmonycloud.cn> Helen-xie <xieyulin821@harmonycloud.cn>
+Mike Brown <brownwm@us.ibm.com> Mike Brown <mikebrow@users.noreply.github.com>
+Manish Tomar <manish.tomar@docker.com> Manish Tomar <manishtomar@users.noreply.github.com>
+Sakeven Jiang <jc5930@sina.cn> sakeven <jc5930@sina.cn>
@@ -0,0 +1,51 @@
+dist: trusty
+sudo: required
+# setup travis so that we can run containers for integration tests
+services:
+  - docker
+
+language: go
+
+go:
+  - "1.11.x"
+
+go_import_path: github.com/docker/distribution
+
+addons:
+  apt:
+    packages:
+      - python-minimal
+
+
+env:
+  - TRAVIS_GOOS=linux DOCKER_BUILDTAGS="include_oss include_gcs" TRAVIS_CGO_ENABLED=1
+
+before_install:
+  - uname -r
+  - sudo apt-get -q update
+
+install:
+  - go get -u github.com/vbatts/git-validation
+    # TODO: Add enforcement of license
+    # - go get -u github.com/kunalkushwaha/ltag
+  - cd $TRAVIS_BUILD_DIR
+
+script:
+  - export GOOS=$TRAVIS_GOOS
+  - export CGO_ENABLED=$TRAVIS_CGO_ENABLED
+  - DCO_VERBOSITY=-q script/validate/dco
+  - GOOS=linux script/setup/install-dev-tools
+  - script/validate/vendor
+  - go build -i .
+  - make check
+  - make build
+  - make binaries
+    # Currently takes too long
+    #- if [ "$GOOS" = "linux" ]; then make test-race ; fi
+  - if [ "$GOOS" = "linux" ]; then make coverage ; fi
+
+after_success:
+  - bash <(curl -s https://codecov.io/bash) -F linux
+
+before_deploy:
+    # Run tests with storage driver configurations
@@ -1,182 +0,0 @@
-a-palchikov <deemok@gmail.com>
-Aaron Lehmann <aaron.lehmann@docker.com>
-Aaron Schlesinger <aschlesinger@deis.com>
-Aaron Vinson <avinson.public@gmail.com>
-Adam Duke <adam.v.duke@gmail.com>
-Adam Enger <adamenger@gmail.com>
-Adrian Mouat <adrian.mouat@gmail.com>
-Ahmet Alp Balkan <ahmetalpbalkan@gmail.com>
-Alex Chan <alex.chan@metaswitch.com>
-Alex Elman <aelman@indeed.com>
-Alexey Gladkov <gladkov.alexey@gmail.com>
-allencloud <allen.sun@daocloud.io>
-amitshukla <ashukla73@hotmail.com>
-Amy Lindburg <amy.lindburg@docker.com>
-Andrew Hsu <andrewhsu@acm.org>
-Andrew Meredith <andymeredith@gmail.com>
-Andrew T Nguyen <andrew.nguyen@docker.com>
-Andrey Kostov <kostov.andrey@gmail.com>
-Andy Goldstein <agoldste@redhat.com>
-Anis Elleuch <vadmeste@gmail.com>
-Anton Tiurin <noxiouz@yandex.ru>
-Antonio Mercado <amercado@thinknode.com>
-Antonio Murdaca <runcom@redhat.com>
-Anusha Ragunathan <anusha@docker.com>
-Arien Holthuizen <aholthuizen@schubergphilis.com>
-Arnaud Porterie <arnaud.porterie@docker.com>
-Arthur Baars <arthur@semmle.com>
-Asuka Suzuki <hello@tanksuzuki.com>
-Avi Miller <avi.miller@oracle.com>
-Ayose Cazorla <ayosec@gmail.com>
-BadZen <dave.trombley@gmail.com>
-Ben Bodenmiller <bbodenmiller@hotmail.com>
-Ben Firshman <ben@firshman.co.uk>
-bin liu <liubin0329@gmail.com>
-Brian Bland <brian.bland@docker.com>
-burnettk <burnettk@gmail.com>
-Carson A <ca@carsonoid.net>
-Cezar Sa Espinola <cezarsa@gmail.com>
-Charles Smith <charles.smith@docker.com>
-Chris Dillon <squarism@gmail.com>
-cuiwei13 <cuiwei13@pku.edu.cn>
-cyli <cyli@twistedmatrix.com>
-Daisuke Fujita <dtanshi45@gmail.com>
-Daniel Huhn <daniel@danielhuhn.de>
-Darren Shepherd <darren@rancher.com>
-Dave Trombley <dave.trombley@gmail.com>
-Dave Tucker <dt@docker.com>
-David Lawrence <david.lawrence@docker.com>
-David Verhasselt <david@crowdway.com>
-David Xia <dxia@spotify.com>
-davidli <wenquan.li@hp.com>
-Dejan Golja <dejan@golja.org>
-Derek McGowan <derek@mcgstyle.net>
-Diogo Mónica <diogo.monica@gmail.com>
-DJ Enriquez <dj.enriquez@infospace.com>
-Donald Huang <don.hcd@gmail.com>
-Doug Davis <dug@us.ibm.com>
-Edgar Lee <edgar.lee@docker.com>
-Eric Yang <windfarer@gmail.com>
-Fabio Berchtold <jamesclonk@jamesclonk.ch>
-Fabio Huser <fabio@fh1.ch>
-farmerworking <farmerworking@gmail.com>
-Felix Yan <felixonmars@archlinux.org>
-Florentin Raud <florentin.raud@gmail.com>
-Frank Chen <frankchn@gmail.com>
-Frederick F. Kautz IV <fkautz@alumni.cmu.edu>
-gabriell nascimento <gabriell@bluesoft.com.br>
-Gleb Schukin <gschukin@ptsecurity.com>
-harche <p.harshal@gmail.com>
-Henri Gomez <henri.gomez@gmail.com>
-Hu Keping <hukeping@huawei.com>
-Hua Wang <wanghua.humble@gmail.com>
-HuKeping <hukeping@huawei.com>
-Ian Babrou <ibobrik@gmail.com>
-igayoso <igayoso@gmail.com>
-Jack Griffin <jackpg14@gmail.com>
-James Findley <jfindley@fastmail.com>
-Jason Freidman <jason.freidman@gmail.com>
-Jason Heiss <jheiss@aput.net>
-Jeff Nickoloff <jeff@allingeek.com>
-Jess Frazelle <acidburn@google.com>
-Jessie Frazelle <jessie@docker.com>
-jhaohai <jhaohai@foxmail.com>
-Jianqing Wang <tsing@jianqing.org>
-Jihoon Chung <jihoon@gmail.com>
-Joao Fernandes <joao.fernandes@docker.com>
-John Mulhausen <john@docker.com>
-John Starks <jostarks@microsoft.com>
-Jon Johnson <jonjohnson@google.com>
-Jon Poler <jonathan.poler@apcera.com>
-Jonathan Boulle <jonathanboulle@gmail.com>
-Jordan Liggitt <jliggitt@redhat.com>
-Josh Chorlton <josh.chorlton@docker.com>
-Josh Hawn <josh.hawn@docker.com>
-Julien Fernandez <julien.fernandez@gmail.com>
-Ke Xu <leonhartx.k@gmail.com>
-Keerthan Mala <kmala@engineyard.com>
-Kelsey Hightower <kelsey.hightower@gmail.com>
-Kenneth Lim <kennethlimcp@gmail.com>
-Kenny Leung <kleung@google.com>
-Li Yi <denverdino@gmail.com>
-Liu Hua <sdu.liu@huawei.com>
-liuchang0812 <liuchang0812@gmail.com>
-Lloyd Ramey <lnr0626@gmail.com>
-Louis Kottmann <louis.kottmann@gmail.com>
-Luke Carpenter <x@rubynerd.net>
-Marcus Martins <marcus@docker.com>
-Mary Anthony <mary@docker.com>
-Matt Bentley <mbentley@mbentley.net>
-Matt Duch <matt@learnmetrics.com>
-Matt Moore <mattmoor@google.com>
-Matt Robenolt <matt@ydekproductions.com>
-Matthew Green <greenmr@live.co.uk>
-Michael Prokop <mika@grml.org>
-Michal Minar <miminar@redhat.com>
-Michal Minář <miminar@redhat.com>
-Mike Brown <brownwm@us.ibm.com>
-Miquel Sabaté <msabate@suse.com>
-Misty Stanley-Jones <misty@apache.org>
-Misty Stanley-Jones <misty@docker.com>
-Morgan Bauer <mbauer@us.ibm.com>
-moxiegirl <mary@docker.com>
-Nathan Sullivan <nathan@nightsys.net>
-nevermosby <robolwq@qq.com>
-Nghia Tran <tcnghia@gmail.com>
-Nikita Tarasov <nikita@mygento.ru>
-Noah Treuhaft <noah.treuhaft@docker.com>
-Nuutti Kotivuori <nuutti.kotivuori@poplatek.fi>
-Oilbeater <liumengxinfly@gmail.com>
-Olivier Gambier <olivier@docker.com>
-Olivier Jacques <olivier.jacques@hp.com>
-Omer Cohen <git@omer.io>
-Patrick Devine <patrick.devine@docker.com>
-Phil Estes <estesp@linux.vnet.ibm.com>
-Philip Misiowiec <philip@atlashealth.com>
-Pierre-Yves Ritschard <pyr@spootnik.org>
-Qiao Anran <qiaoanran@gmail.com>
-Randy Barlow <randy@electronsweatshop.com>
-Richard Scothern <richard.scothern@docker.com>
-Rodolfo Carvalho <rhcarvalho@gmail.com>
-Rusty Conover <rusty@luckydinosaur.com>
-Sean Boran <Boran@users.noreply.github.com>
-Sebastiaan van Stijn <github@gone.nl>
-Sebastien Coavoux <s.coavoux@free.fr>
-Serge Dubrouski <sergeyfd@gmail.com>
-Sharif Nassar <sharif@mrwacky.com>
-Shawn Falkner-Horine <dreadpirateshawn@gmail.com>
-Shreyas Karnik <karnik.shreyas@gmail.com>
-Simon Thulbourn <simon+github@thulbourn.com>
-spacexnice <yaoyao.xyy@alibaba-inc.com>
-Spencer Rinehart <anubis@overthemonkey.com>
-Stan Hu <stanhu@gmail.com>
-Stefan Majewsky <stefan.majewsky@sap.com>
-Stefan Weil <sw@weilnetz.de>
-Stephen J Day <stephen.day@docker.com>
-Sungho Moon <sungho.moon@navercorp.com>
-Sven Dowideit <SvenDowideit@home.org.au>
-Sylvain Baubeau <sbaubeau@redhat.com>
-Ted Reed <ted.reed@gmail.com>
-tgic <farmer1992@gmail.com>
-Thomas Sjögren <konstruktoid@users.noreply.github.com>
-Tianon Gravi <admwiggin@gmail.com>
-Tibor Vass <teabee89@gmail.com>
-Tonis Tiigi <tonistiigi@gmail.com>
-Tony Holdstock-Brown <tony@docker.com>
-Trevor Pounds <trevor.pounds@gmail.com>
-Troels Thomsen <troels@thomsen.io>
-Victor Vieux <vieux@docker.com>
-Victoria Bialas <victoria.bialas@docker.com>
-Vincent Batts <vbatts@redhat.com>
-Vincent Demeester <vincent@sbr.pm>
-Vincent Giersch <vincent.giersch@ovh.net>
-W. Trevor King <wking@tremily.us>
-weiyuan.yl <weiyuan.yl@alibaba-inc.com>
-xg.song <xg.song@venusource.com>
-xiekeyang <xiekeyang@huawei.com>
-Yann ROBERT <yann.robert@anantaplex.fr>
-yaoyao.xyy <yaoyao.xyy@alibaba-inc.com>
-yuexiao-wang <wang.yuexiao@zte.com.cn>
-yuzou <zouyu7@huawei.com>
-zhouhaibing089 <zhouhaibing089@gmail.com>
-姜继忠 <jizhong.jiangjz@alibaba-inc.com>
@@ -1,108 +0,0 @@
-# Changelog
-
-## 2.6.0 (2017-01-18)
-
-#### Storage
- S3: fixed bug in delete due to read-after-write inconsistency
- S3: allow EC2 IAM roles to be used when authorizing region endpoints
- S3: add Object ACL Support
- S3: fix delete method's notion of subpaths
- S3: use multipart upload API in `Move` method for performance
- S3: add v2 signature signing for legacy S3 clones
- Swift: add simple heuristic to detect incomplete DLOs during read ops
- Swift: support different user and tenant domains
- Swift: bulk deletes in chunks
- Aliyun OSS: fix delete method's notion of subpaths
- Aliyun OSS: optimize data copy after upload finishes
- Azure: close leaking response body
- Fix storage drivers dropping non-EOF errors when listing repositories
- Compare path properly when listing repositories in catalog
- Add a foreign layer URL host whitelist
- Improve catalog enumerate runtime
-
-#### Registry
- Export `storage.CreateOptions` in top-level package
- Enable notifications to endpoints that use self-signed certificates
- Properly validate multi-URL foreign layers
- Add control over validation of URLs in pushed manifests
- Proxy mode: fix socket leak when pull is cancelled
- Tag service: properly handle error responses on HEAD request
- Support for custom authentication URL in proxying registry
- Add configuration option to disable access logging
- Add notification filtering by target media type
- Manifest: `References()` returns all children
- Honor `X-Forwarded-Port` and Forwarded headers
- Reference: Preserve tag and digest in With* functions
- Add policy configuration for enforcing repository classes
-
-#### Client
- Changes the client Tags `All()` method to follow links
- Allow registry clients to connect via HTTP2
- Better handling of OAuth errors in client
-  
-#### Spec
- Manifest: clarify relationship between urls and foreign layers
- Authorization: add support for repository classes
-
-#### Manifest
- Override media type returned from `Stat()` for existing manifests
- Add plugin mediatype to distribution manifest
-
-#### Docs
- Document `TOOMANYREQUESTS` error code
- Document required Let's Encrypt port
- Improve documentation around implementation of OAuth2
- Improve documentation for configuration
-
-#### Auth
- Add support for registry type in scope
- Add support for using v2 ping challenges for v1
- Add leeway to JWT `nbf` and `exp` checking
- htpasswd: dynamically parse htpasswd file
- Fix missing auth headers with PATCH HTTP request when pushing to default port
-
-#### Dockerfile
- Update to go1.7
- Reorder Dockerfile steps for better layer caching
-
-#### Notes
-
-Documentation has moved to the documentation repository at
-`github.com/docker/docker.github.io/tree/master/registry`
-
-The registry is go 1.7 compliant, and passes newer, more restrictive `lint` and `vet` ing.
-
-
-## 2.5.0 (2016-06-14)
-
-#### Storage
- Ensure uploads directory is cleaned after upload is committed
- Add ability to cap concurrent operations in filesystem driver
- S3: Add 'us-gov-west-1' to the valid region list
- Swift: Handle ceph not returning Last-Modified header for HEAD requests
- Add redirect middleware
-
-#### Registry
- Add support for blobAccessController middleware
- Add support for layers from foreign sources
- Remove signature store
- Add support for Let's Encrypt
- Correct yaml key names in configuration
-
-#### Client
- Add option to get content digest from manifest get
-
-#### Spec
- Update the auth spec scope grammar to reflect the fact that hostnames are optionally supported
- Clarify API documentation around catalog fetch behavior
-
-#### API
- Support returning HTTP 429 (Too Many Requests)
-
-#### Documentation
- Update auth documentation examples to show "expires in" as int
-
-#### Docker Image
- Use Alpine Linux as base image
-
-
@@ -1,20 +1,22 @@
-FROM golang:1.10-alpine
+FROM golang:1.11-alpine AS build

 ENV DISTRIBUTION_DIR /go/src/github.com/docker/distribution
 ENV DOCKER_BUILDTAGS include_oss include_gcs

 ARG GOOS=linux
 ARG GOARCH=amd64
+ARG GOARM=6

 RUN set -ex \
-    && apk add --no-cache make git
+    && apk add --no-cache make git file

 WORKDIR $DISTRIBUTION_DIR
 COPY . $DISTRIBUTION_DIR
+RUN CGO_ENABLED=0 make PREFIX=/go clean binaries && file ./bin/registry | grep "statically linked"
+
+FROM alpine
 COPY cmd/registry/config-dev.yml /etc/docker/registry/config.yml
-
-RUN make PREFIX=/go clean binaries
-
+COPY --from=build /go/src/github.com/docker/distribution/bin/registry /bin/registry
 VOLUME ["/var/lib/registry"]
 EXPOSE 5000
 ENTRYPOINT ["registry"]
@@ -6,18 +6,198 @@
 # It is structured to be consumable by both humans and programs.
 # To extract its contents programmatically, use any TOML-compliant parser.
 #
-# This file is compiled into the MAINTAINERS file in docker/opensource.
-#
+
+[Rules]
+
+	[Rules.maintainers]
+
+	title = "What is a maintainer?"
+
+	text = """
+There are different types of maintainers, with different responsibilities, but
+all maintainers have 3 things in common:
+
+1) They share responsibility in the project's success.
+2) They have made a long-term, recurring time investment to improve the project.
+3) They spend that time doing whatever needs to be done, not necessarily what
+is the most interesting or fun.
+
+Maintainers are often under-appreciated, because their work is harder to appreciate.
+It's easy to appreciate a really cool and technically advanced feature. It's harder
+to appreciate the absence of bugs, the slow but steady improvement in stability,
+or the reliability of a release process. But those things distinguish a good
+project from a great one.
+"""
+
+	[Rules.reviewer]
+
+	title = "What is a reviewer?"
+
+	text = """
+A reviewer is a core role within the project.
+They share in reviewing issues and pull requests and their LGTM count towards the
+required LGTM count to merge a code change into the project.
+
+Reviewers are part of the organization but do not have write access.
+Becoming a reviewer is a core aspect in the journey to becoming a maintainer.
+"""
+
+	[Rules.adding-maintainers]
+
+	title = "How are maintainers added?"
+
+	text = """
+Maintainers are first and foremost contributors that have shown they are
+committed to the long term success of a project. Contributors wanting to become
+maintainers are expected to be deeply involved in contributing code, pull
+request review, and triage of issues in the project for more than three months.
+
+Just contributing does not make you a maintainer, it is about building trust
+with the current maintainers of the project and being a person that they can
+depend on and trust to make decisions in the best interest of the project.
+
+Periodically, the existing maintainers curate a list of contributors that have
+shown regular activity on the project over the prior months. From this list,
+maintainer candidates are selected and proposed on the maintainers mailing list.
+
+After a candidate has been announced on the maintainers mailing list, the
+existing maintainers are given five business days to discuss the candidate,
+raise objections and cast their vote. Candidates must be approved by at least 66% of the current maintainers by adding their vote on the mailing
+list. Only maintainers of the repository that the candidate is proposed for are
+allowed to vote.
+
+If a candidate is approved, a maintainer will contact the candidate to invite
+the candidate to open a pull request that adds the contributor to the
+MAINTAINERS file. The candidate becomes a maintainer once the pull request is
+merged.
+"""
+
+	[Rules.stepping-down-policy]
+
+	title = "Stepping down policy"
+
+	text = """
+Life priorities, interests, and passions can change. If you're a maintainer but
+feel you must remove yourself from the list, inform other maintainers that you
+intend to step down, and if possible, help find someone to pick up your work.
+At the very least, ensure your work can be continued where you left off.
+
+After you've informed other maintainers, create a pull request to remove
+yourself from the MAINTAINERS file.
+"""
+
+	[Rules.inactive-maintainers]
+
+	title = "Removal of inactive maintainers"
+
+	text = """
+Similar to the procedure for adding new maintainers, existing maintainers can
+be removed from the list if they do not show significant activity on the
+project. Periodically, the maintainers review the list of maintainers and their
+activity over the last three months.
+
+If a maintainer has shown insufficient activity over this period, a neutral
+person will contact the maintainer to ask if they want to continue being
+a maintainer. If the maintainer decides to step down as a maintainer, they
+open a pull request to be removed from the MAINTAINERS file.
+
+If the maintainer wants to remain a maintainer, but is unable to perform the
+required duties they can be removed with a vote of at least 66% of
+the current maintainers. An e-mail is sent to the
+mailing list, inviting maintainers of the project to vote. The voting period is
+five business days. Issues related to a maintainer's performance should be
+discussed with them among the other maintainers so that they are not surprised
+by a pull request removing them.
+"""
+
+	[Rules.decisions]
+
+	title = "How are decisions made?"
+
+	text = """
+Short answer: EVERYTHING IS A PULL REQUEST.
+
+distribution is an open-source project with an open design philosophy. This means
+that the repository is the source of truth for EVERY aspect of the project,
+including its philosophy, design, road map, and APIs. *If it's part of the
+project, it's in the repo. If it's in the repo, it's part of the project.*
+
+As a result, all decisions can be expressed as changes to the repository. An
+implementation change is a change to the source code. An API change is a change
+to the API specification. A philosophy change is a change to the philosophy
+manifesto, and so on.
+
+All decisions affecting distribution, big and small, follow the same 3 steps:
+
+* Step 1: Open a pull request. Anyone can do this.
+
+* Step 2: Discuss the pull request. Anyone can do this.
+
+* Step 3: Merge or refuse the pull request. Who does this depends on the nature
+of the pull request and which areas of the project it affects.
+"""
+
+	[Rules.DCO]
+
+	title = "Helping contributors with the DCO"
+
+	text = """
+The [DCO or `Sign your work`](
+https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work)
+requirement is not intended as a roadblock or speed bump.
+
+Some distribution contributors are not as familiar with `git`, or have used a web
+based editor, and thus asking them to `git commit --amend -s` is not the best
+way forward.
+
+In this case, maintainers can update the commits based on clause (c) of the DCO.
+The most trivial way for a contributor to allow the maintainer to do this, is to
+add a DCO signature in a pull requests's comment, or a maintainer can simply
+note that the change is sufficiently trivial that it does not substantially
+change the existing contribution - i.e., a spelling change.
+
+When you add someone's DCO, please also add your own to keep a log.
+"""
+
+	[Rules."no direct push"]
+
+	title = "I'm a maintainer. Should I make pull requests too?"
+
+	text = """
+Yes. Nobody should ever push to master directly. All changes should be
+made through a pull request.
+"""
+
+	[Rules.tsc]
+
+	title = "Conflict Resolution and technical disputes"
+
+	text = """
+distribution defers to the [Technical Steering Committee](https://github.com/moby/tsc) for escalations and resolution on disputes for technical matters."
+	"""
+
+	[Rules.meta]
+
+	title = "How is this process changed?"
+
+	text = "Just like everything else: by making a pull request :)"
+
+# Current project organization
 [Org]
-	[Org."Core maintainers"]
+
+	[Org.Maintainers]
 		people = [
-			"aaronlehmann",
 			"dmcgowan",
 			"dmp42",
-			"richardscothern",
-			"shykes",
 			"stevvooe",
 		]
+	[Org.Reviewers]
+		people = [
+			"manishtomar",
+			"caervs",
+			"davidswu",
+			"RobbKistler"
+		]

 [people]

@@ -27,10 +207,15 @@

 	# ADD YOURSELF HERE IN ALPHABETICAL ORDER

-	[people.aaronlehmann]
-	Name = "Aaron Lehmann"
-	Email = "aaron.lehmann@docker.com"
-	GitHub = "aaronlehmann"
+	[people.caervs]
+	Name = "Ryan Abrams"
+	Email = "rdabrams@gmail.com"
+	GitHub = "caervs"
+
+	[people.davidswu]
+	Name = "David Wu"
+	Email = "dwu7401@gmail.com"
+	GitHub = "davidswu"

 	[people.dmcgowan]
 	Name = "Derek McGowan"
@@ -42,15 +227,15 @@
 	Email = "olivier@docker.com"
 	GitHub = "dmp42"

-	[people.richardscothern]
-	Name = "Richard Scothern"
-	Email = "richard.scothern@gmail.com"
-	GitHub = "richardscothern"
+	[people.manishtomar]
+	Name = "Manish Tomar"
+	Email = "manish.tomar@docker.com"
+	GitHub = "manishtomar"

-	[people.shykes]
-	Name = "Solomon Hykes"
-	Email = "solomon@docker.com"
-	GitHub = "shykes"
+	[people.RobbKistler]
+	Name = "Robb Kistler"
+	Email = "robb.kistler@docker.com"
+	GitHub = "RobbKistler"

 	[people.stevvooe]
 	Name = "Stephen Day"
@@ -1,9 +1,21 @@
-# Set an output prefix, which is the local directory if not specified
-PREFIX?=$(shell pwd)
-
+# Root directory of the project (absolute path).
+ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST))))

 # Used to populate version variable in main package.
 VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
+REVISION=$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
+
+
+PKG=github.com/docker/distribution
+
+# Project packages.
+PACKAGES=$(shell go list -tags "${BUILDTAGS}" ./... | grep -v /vendor/)
+INTEGRATION_PACKAGE=${PKG}
+COVERAGE_PACKAGES=$(filter-out ${PKG}/registry/storage/driver/%,${PACKAGES})
+
+
+# Project binaries.
+COMMANDS=registry digest registry-api-descriptor-template

 # Allow turning off function inlining and variable registerization
 ifeq (${DISABLE_OPTIMIZATION},true)
@@ -11,89 +23,80 @@ ifeq (${DISABLE_OPTIMIZATION},true)
 	VERSION:="$(VERSION)-noopt"
 endif

-GO_LDFLAGS=-ldflags "-X `go list ./version`.Version=$(VERSION)"
+WHALE = "+"

-.PHONY: all build binaries clean dep-restore dep-save dep-validate fmt lint test test-full vet
+# Go files
+#
+TESTFLAGS_RACE=
+GOFILES=$(shell find . -type f -name '*.go')
+GO_TAGS=$(if $(BUILDTAGS),-tags "$(BUILDTAGS)",)
+GO_LDFLAGS=-ldflags '-s -w -X $(PKG)/version.Version=$(VERSION) -X $(PKG)/version.Revision=$(REVISION) -X $(PKG)/version.Package=$(PKG) $(EXTRA_LDFLAGS)'
+
+BINARIES=$(addprefix bin/,$(COMMANDS))
+
+# Flags passed to `go test`
+TESTFLAGS ?= -v $(TESTFLAGS_RACE)
+TESTFLAGS_PARALLEL ?= 8
+
+.PHONY: all build binaries check clean test test-race test-full integration coverage
 .DEFAULT: all
-all: fmt vet lint build test binaries

-AUTHORS: .mailmap .git/HEAD
-	 git log --format='%aN <%aE>' | sort -fu > $@
+all: binaries

 # This only needs to be generated by hand when cutting full releases.
 version/version.go:
+	@echo "$(WHALE) $@"
 	./version/version.sh > $@

-# Required for go 1.5 to build
-GO15VENDOREXPERIMENT := 1
+check: ## run all linters (TODO: enable "unused", "varcheck", "ineffassign", "unconvert", "staticheck", "goimports", "structcheck")
+	@echo "$(WHALE) $@"
+	gometalinter --config .gometalinter.json ./...

-# Go files
-GOFILES=$(shell find . -type f -name '*.go')
+test: ## run tests, except integration test with test.short
+	@echo "$(WHALE) $@"
+	@go test ${GO_TAGS} -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})

-# Package list
-PKGS=$(shell go list -tags "${DOCKER_BUILDTAGS}" ./... | grep -v ^github.com/docker/distribution/vendor/)
+test-race: ## run tests, except integration test with test.short and race
+	@echo "$(WHALE) $@"
+	@go test ${GO_TAGS} -race -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})

-# Resolving binary dependencies for specific targets
-GOLINT=$(shell which golint || echo '')
-VNDR=$(shell which vndr || echo '')
+test-full: ## run tests, except integration tests
+	@echo "$(WHALE) $@"
+	@go test ${GO_TAGS} ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})

-${PREFIX}/bin/registry: $(GOFILES)
-	@echo "+ $@"
-	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/registry
+integration: ## run integration tests
+	@echo "$(WHALE) $@"
+	@go test ${TESTFLAGS} -parallel ${TESTFLAGS_PARALLEL} ${INTEGRATION_PACKAGE}

-${PREFIX}/bin/digest:  $(GOFILES)
-	@echo "+ $@"
-	@go build -tags "${DOCKER_BUILDTAGS}" -o $@ ${GO_LDFLAGS}  ${GO_GCFLAGS} ./cmd/digest
+coverage: ## generate coverprofiles from the unit tests
+	@echo "$(WHALE) $@"
+	@rm -f coverage.txt
+	@go test ${GO_TAGS} -i ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${COVERAGE_PACKAGES}) 2> /dev/null
+	@( for pkg in $(filter-out ${INTEGRATION_PACKAGE},${COVERAGE_PACKAGES}); do \
+		go test ${GO_TAGS} ${TESTFLAGS} \
+			-cover \
+			-coverprofile=profile.out \
+			-covermode=atomic $$pkg || exit; \
+		if [ -f profile.out ]; then \
+			cat profile.out >> coverage.txt; \
+			rm profile.out; \
+		fi; \
+	done )

-${PREFIX}/bin/registry-api-descriptor-template: $(GOFILES)
-	@echo "+ $@"
-	@go build -o $@ ${GO_LDFLAGS} ${GO_GCFLAGS} ./cmd/registry-api-descriptor-template
+FORCE:

-docs/spec/api.md: docs/spec/api.md.tmpl ${PREFIX}/bin/registry-api-descriptor-template
-	./bin/registry-api-descriptor-template $< > $@
+# Build a binary from a cmd.
+bin/%: cmd/% FORCE
+	@echo "$(WHALE) $@${BINARY_SUFFIX}"
+	@go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} ${GO_TAGS}  ./$<

-vet:
-	@echo "+ $@"
-	@go vet -tags "${DOCKER_BUILDTAGS}" $(PKGS)
-
-fmt:
-	@echo "+ $@"
-	@test -z "$$(gofmt -s -l . 2>&1 | grep -v ^vendor/ | tee /dev/stderr)" || \
-		(echo >&2 "+ please format Go code with 'gofmt -s'" && false)
-
-lint:
-	@echo "+ $@"
-	$(if $(GOLINT), , \
-		$(error Please install golint: `go get -u github.com/golang/lint/golint`))
-	@test -z "$$($(GOLINT) ./... 2>&1 | grep -v ^vendor/ | tee /dev/stderr)"
+binaries: $(BINARIES) ## build binaries
+	@echo "$(WHALE) $@"

 build:
-	@echo "+ $@"
-	@go build -tags "${DOCKER_BUILDTAGS}" -v ${GO_LDFLAGS} $(PKGS)
+	@echo "$(WHALE) $@"
+	@go build ${GO_GCFLAGS} ${GO_BUILD_FLAGS} ${GO_LDFLAGS} ${GO_TAGS} $(PACKAGES)

-test:
-	@echo "+ $@"
-	@go test -test.short -tags "${DOCKER_BUILDTAGS}" $(PKGS)
-
-test-full:
-	@echo "+ $@"
-	@go test -tags "${DOCKER_BUILDTAGS}" $(PKGS)
-
-binaries: ${PREFIX}/bin/registry ${PREFIX}/bin/digest ${PREFIX}/bin/registry-api-descriptor-template
-	@echo "+ $@"
-
-clean:
-	@echo "+ $@"
-	@rm -rf "${PREFIX}/bin/registry" "${PREFIX}/bin/digest" "${PREFIX}/bin/registry-api-descriptor-template"
-
-dep-validate:
-	@echo "+ $@"
-	$(if $(VNDR), , \
-		$(error Please install vndr: go get github.com/lk4d4/vndr))
-	@rm -Rf .vendor.bak
-	@mv vendor .vendor.bak
-	@$(VNDR)
-	@test -z "$$(diff -r vendor .vendor.bak 2>&1 | tee /dev/stderr)" || \
-		(echo >&2 "+ inconsistent dependencies! what you have in vendor.conf does not match with what you have in vendor" && false)
-	@rm -Rf vendor
-	@mv .vendor.bak vendor
+clean: ## clean up binaries
+	@echo "$(WHALE) $@"
+	@rm -f $(BINARIES)
@@ -1,44 +0,0 @@
-## Registry Release Checklist
-
-10. Compile release notes detailing features and since the last release.
-
-  Update the `CHANGELOG.md` file and create a PR to master with the updates.
-Once that PR has been approved by maintainers the change may be cherry-picked
-to the release branch (new release branches may be forked from this commit).
-
-20. Update the version file: `https://github.com/docker/distribution/blob/master/version/version.go`
-
-30. Update the `MAINTAINERS` (if necessary), `AUTHORS` and `.mailmap` files.
-
-```
-make AUTHORS
-```
-
-40. Create a signed tag.
-
-   Distribution uses semantic versioning.  Tags are of the format
-`vx.y.z[-rcn]`. You will need PGP installed and a PGP key which has been added
-to your Github account. The comment for the tag should include the release
-notes, use previous tags as a guide for formatting consistently. Run
-`git tag -s vx.y.z[-rcn]` to create tag and `git -v vx.y.z[-rcn]` to verify tag,
-check comment and correct commit hash.
-
-50. Push the signed tag
-
-60. Create a new [release](https://github.com/docker/distribution/releases).  In the case of a release candidate, tick the `pre-release` checkbox. 
-
-70. Update the registry binary in [distribution library image repo](https://github.com/docker/distribution-library-image) by running the update script and  opening a pull request.
-
-80. Update the official image.  Add the new version in the [official images repo](https://github.com/docker-library/official-images) by appending a new version to the `registry/registry` file with the git hash pointed to by the signed tag.  Update the major version to point to the latest version and the minor version to point to new patch release if necessary.
-e.g. to release `2.3.1`
-
-   `2.3.1 (new)`
-
-   `2.3.0 -> 2.3.0` can be removed
-
-   `2 -> 2.3.1`
-
-   `2.3 -> 2.3.1`
-
-90. Build a new distribution/registry image on [Docker hub](https://hub.docker.com/u/distribution/dashboard) by adding a new automated build with the new tag and re-building the images.
-
@@ -67,7 +67,7 @@ type Descriptor struct {
 	Size int64 `json:"size,omitempty"`

 	// Digest uniquely identifies the content. A byte stream can be verified
-	// against against this digest.
+	// against this digest.
 	Digest digest.Digest `json:"digest,omitempty"`

 	// URLs contains the source URLs of this content.
@@ -1,94 +0,0 @@
-# Pony-up!
-machine:
-  pre:
-  # Install gvm
-    - bash < <(curl -s -S -L https://raw.githubusercontent.com/moovweb/gvm/1.0.22/binscripts/gvm-installer)
-  # Install codecov for coverage
-    - pip install --user codecov
-
-  post:
-  # go
-    - gvm install go1.10 --prefer-binary --name=stable
-
-  environment:
-  # Convenient shortcuts to "common" locations
-    CHECKOUT: /home/ubuntu/$CIRCLE_PROJECT_REPONAME
-    BASE_DIR: src/github.com/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME
-  # Trick circle brainflat "no absolute path" behavior
-    BASE_STABLE: ../../../$HOME/.gvm/pkgsets/stable/global/$BASE_DIR
-    DOCKER_BUILDTAGS: "include_oss include_gcs"
-  # Workaround Circle parsing dumb bugs and/or YAML wonkyness
-    CIRCLE_PAIN: "mode: set"
-
-  hosts:
-  # Not used yet
-    fancy: 127.0.0.1
-
-dependencies:
-  pre:
-  # Copy the code to the gopath of all go versions
-    - >
-      gvm use stable &&
-      mkdir -p "$(dirname $BASE_STABLE)" &&
-      cp -R "$CHECKOUT" "$BASE_STABLE"
-
-  override:
-  # Install dependencies for every copied clone/go version
-    - gvm use stable && go get github.com/lk4d4/vndr:
-        pwd: $BASE_STABLE
-
-  post:
-  # For the stable go version, additionally install linting tools
-    - >
-      gvm use stable &&
-      go get github.com/axw/gocov/gocov github.com/golang/lint/golint
-
-test:
-  pre:
-  # Output the go versions we are going to test
-    # - gvm use old && go version
-    - gvm use stable && go version
-
-  # Ensure validation of dependencies
-    - git fetch origin:
-        pwd: $BASE_STABLE
-    - gvm use stable && if test -n "`git diff --stat=1000 origin/master | grep -E \"^[[:space:]]*vendor\"`"; then make dep-validate; fi:
-        pwd: $BASE_STABLE
-
-  # First thing: build everything. This will catch compile errors, and it's
-  # also necessary for go vet to work properly (see #807).
-    - gvm use stable && go install $(go list ./... | grep -v "/vendor/"):
-        pwd: $BASE_STABLE
-
-  # FMT
-    - gvm use stable && make fmt:
-        pwd: $BASE_STABLE
-
-   # VET
-    - gvm use stable && make vet:
-        pwd: $BASE_STABLE
-
-  # LINT
-    - gvm use stable && make lint:
-        pwd: $BASE_STABLE
-
-  override:
-  # Test stable, and report
-     - gvm use stable; export ROOT_PACKAGE=$(go list .); go list -tags "$DOCKER_BUILDTAGS" ./... | grep -v "/vendor/" | xargs -L 1 -I{} bash -c 'export PACKAGE={}; go test -tags "$DOCKER_BUILDTAGS" -test.short -coverprofile=$GOPATH/src/$PACKAGE/coverage.out -coverpkg=$(./coverpkg.sh $PACKAGE $ROOT_PACKAGE) $PACKAGE':
-         timeout: 1000
-         pwd: $BASE_STABLE
-
-  # Test stable with race
-     - gvm use stable; export ROOT_PACKAGE=$(go list .); go list -tags "$DOCKER_BUILDTAGS" ./... | grep -v "/vendor/" | grep -v "registry/handlers" | grep -v "registry/storage/driver" | xargs -L 1 -I{} bash -c 'export PACKAGE={}; go test -race -tags "$DOCKER_BUILDTAGS" -test.short $PACKAGE':
-         timeout: 1000
-         pwd: $BASE_STABLE
-  post:
-  # Report to codecov
-    - bash <(curl -s https://codecov.io/bash):
-        pwd: $BASE_STABLE
-
-  ## Notes
-  # Do we want these as well?
-  # - go get code.google.com/p/go.tools/cmd/goimports
-  # - test -z "$(goimports -l -w ./... | tee /dev/stderr)"
-  # http://labix.org/gocheck
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-# Given a subpackage and the containing package, figures out which packages
-# need to be passed to `go test -coverpkg`:  this includes all of the
-# subpackage's dependencies within the containing package, as well as the
-# subpackage itself.
-DEPENDENCIES="$(go list -f $'{{range $f := .Deps}}{{$f}}\n{{end}}' ${1} | grep ${2} | grep -v github.com/docker/distribution/vendor)"
-echo "${1} ${DEPENDENCIES}" | xargs echo -n | tr ' ' ','
@@ -20,6 +20,10 @@ var ErrManifestNotModified = errors.New("manifest not modified")
 // performed
 var ErrUnsupported = errors.New("operation unsupported")

+// ErrSchemaV1Unsupported is returned when a client tries to upload a schema v1
+// manifest but the registry is configured to reject it
+var ErrSchemaV1Unsupported = errors.New("manifest schema v1 unsupported")
+
 // ErrTagUnknown is returned if the given tag is not known by the tag service
 type ErrTagUnknown struct {
 	Tag string
@@ -87,7 +87,7 @@ func ManifestMediaTypes() (mediaTypes []string) {
 // UnmarshalFunc implements manifest unmarshalling a given MediaType
 type UnmarshalFunc func([]byte) (Manifest, Descriptor, error)

-var mappings = make(map[string]UnmarshalFunc, 0)
+var mappings = make(map[string]UnmarshalFunc)

 // UnmarshalManifest looks up manifest unmarshal functions based on
 // MediaType
@@ -56,6 +56,35 @@ func ParseNormalizedNamed(s string) (Named, error) {
 	return named, nil
 }

+// ParseDockerRef normalizes the image reference following the docker convention. This is added
+// mainly for backward compatibility.
+// The reference returned can only be either tagged or digested. For reference contains both tag
+// and digest, the function returns digested reference, e.g. docker.io/library/busybox:latest@
+// sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa will be returned as
+// docker.io/library/busybox@sha256:7cc4b5aefd1d0cadf8d97d4350462ba51c694ebca145b08d7d41b41acc8db5aa.
+func ParseDockerRef(ref string) (Named, error) {
+	named, err := ParseNormalizedNamed(ref)
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := named.(NamedTagged); ok {
+		if canonical, ok := named.(Canonical); ok {
+			// The reference is both tagged and digested, only
+			// return digested.
+			newNamed, err := WithName(canonical.Name())
+			if err != nil {
+				return nil, err
+			}
+			newCanonical, err := WithDigest(newNamed, canonical.Digest())
+			if err != nil {
+				return nil, err
+			}
+			return newCanonical, nil
+		}
+	}
+	return TagNameOnly(named), nil
+}
+
 // splitDockerDomain splits a repository name to domain and remotename string.
 // If no valid domain is found, the default domain is used. Repository name
 // needs to be already validated before.
@@ -205,7 +205,7 @@ func Parse(s string) (Reference, error) {
 	var repo repository

 	nameMatch := anchoredNameRegexp.FindStringSubmatch(matches[1])
-	if nameMatch != nil && len(nameMatch) == 3 {
+	if len(nameMatch) == 3 {
 		repo.domain = nameMatch[1]
 		repo.path = nameMatch[2]
 	} else {
@@ -54,6 +54,11 @@ type RepositoryEnumerator interface {
 	Enumerate(ctx context.Context, ingester func(string) error) error
 }

+// RepositoryRemover removes given repository
+type RepositoryRemover interface {
+	Remove(ctx context.Context, name reference.Named) error
+}
+
 // ManifestServiceOption is a function argument for Manifest Service methods
 type ManifestServiceOption interface {
 	Apply(ManifestService) error
@@ -0,0 +1,267 @@
+package errcode
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ErrorCoder is the base interface for ErrorCode and Error allowing
+// users of each to just call ErrorCode to get the real ID of each
+type ErrorCoder interface {
+	ErrorCode() ErrorCode
+}
+
+// ErrorCode represents the error type. The errors are serialized via strings
+// and the integer format may change and should *never* be exported.
+type ErrorCode int
+
+var _ error = ErrorCode(0)
+
+// ErrorCode just returns itself
+func (ec ErrorCode) ErrorCode() ErrorCode {
+	return ec
+}
+
+// Error returns the ID/Value
+func (ec ErrorCode) Error() string {
+	// NOTE(stevvooe): Cannot use message here since it may have unpopulated args.
+	return strings.ToLower(strings.Replace(ec.String(), "_", " ", -1))
+}
+
+// Descriptor returns the descriptor for the error code.
+func (ec ErrorCode) Descriptor() ErrorDescriptor {
+	d, ok := errorCodeToDescriptors[ec]
+
+	if !ok {
+		return ErrorCodeUnknown.Descriptor()
+	}
+
+	return d
+}
+
+// String returns the canonical identifier for this error code.
+func (ec ErrorCode) String() string {
+	return ec.Descriptor().Value
+}
+
+// Message returned the human-readable error message for this error code.
+func (ec ErrorCode) Message() string {
+	return ec.Descriptor().Message
+}
+
+// MarshalText encodes the receiver into UTF-8-encoded text and returns the
+// result.
+func (ec ErrorCode) MarshalText() (text []byte, err error) {
+	return []byte(ec.String()), nil
+}
+
+// UnmarshalText decodes the form generated by MarshalText.
+func (ec *ErrorCode) UnmarshalText(text []byte) error {
+	desc, ok := idToDescriptors[string(text)]
+
+	if !ok {
+		desc = ErrorCodeUnknown.Descriptor()
+	}
+
+	*ec = desc.Code
+
+	return nil
+}
+
+// WithMessage creates a new Error struct based on the passed-in info and
+// overrides the Message property.
+func (ec ErrorCode) WithMessage(message string) Error {
+	return Error{
+		Code:    ec,
+		Message: message,
+	}
+}
+
+// WithDetail creates a new Error struct based on the passed-in info and
+// set the Detail property appropriately
+func (ec ErrorCode) WithDetail(detail interface{}) Error {
+	return Error{
+		Code:    ec,
+		Message: ec.Message(),
+	}.WithDetail(detail)
+}
+
+// WithArgs creates a new Error struct and sets the Args slice
+func (ec ErrorCode) WithArgs(args ...interface{}) Error {
+	return Error{
+		Code:    ec,
+		Message: ec.Message(),
+	}.WithArgs(args...)
+}
+
+// Error provides a wrapper around ErrorCode with extra Details provided.
+type Error struct {
+	Code    ErrorCode   `json:"code"`
+	Message string      `json:"message"`
+	Detail  interface{} `json:"detail,omitempty"`
+
+	// TODO(duglin): See if we need an "args" property so we can do the
+	// variable substitution right before showing the message to the user
+}
+
+var _ error = Error{}
+
+// ErrorCode returns the ID/Value of this Error
+func (e Error) ErrorCode() ErrorCode {
+	return e.Code
+}
+
+// Error returns a human readable representation of the error.
+func (e Error) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code.Error(), e.Message)
+}
+
+// WithDetail will return a new Error, based on the current one, but with
+// some Detail info added
+func (e Error) WithDetail(detail interface{}) Error {
+	return Error{
+		Code:    e.Code,
+		Message: e.Message,
+		Detail:  detail,
+	}
+}
+
+// WithArgs uses the passed-in list of interface{} as the substitution
+// variables in the Error's Message string, but returns a new Error
+func (e Error) WithArgs(args ...interface{}) Error {
+	return Error{
+		Code:    e.Code,
+		Message: fmt.Sprintf(e.Code.Message(), args...),
+		Detail:  e.Detail,
+	}
+}
+
+// ErrorDescriptor provides relevant information about a given error code.
+type ErrorDescriptor struct {
+	// Code is the error code that this descriptor describes.
+	Code ErrorCode
+
+	// Value provides a unique, string key, often captilized with
+	// underscores, to identify the error code. This value is used as the
+	// keyed value when serializing api errors.
+	Value string
+
+	// Message is a short, human readable decription of the error condition
+	// included in API responses.
+	Message string
+
+	// Description provides a complete account of the errors purpose, suitable
+	// for use in documentation.
+	Description string
+
+	// HTTPStatusCode provides the http status code that is associated with
+	// this error condition.
+	HTTPStatusCode int
+}
+
+// ParseErrorCode returns the value by the string error code.
+// `ErrorCodeUnknown` will be returned if the error is not known.
+func ParseErrorCode(value string) ErrorCode {
+	ed, ok := idToDescriptors[value]
+	if ok {
+		return ed.Code
+	}
+
+	return ErrorCodeUnknown
+}
+
+// Errors provides the envelope for multiple errors and a few sugar methods
+// for use within the application.
+type Errors []error
+
+var _ error = Errors{}
+
+func (errs Errors) Error() string {
+	switch len(errs) {
+	case 0:
+		return "<nil>"
+	case 1:
+		return errs[0].Error()
+	default:
+		msg := "errors:\n"
+		for _, err := range errs {
+			msg += err.Error() + "\n"
+		}
+		return msg
+	}
+}
+
+// Len returns the current number of errors.
+func (errs Errors) Len() int {
+	return len(errs)
+}
+
+// MarshalJSON converts slice of error, ErrorCode or Error into a
+// slice of Error - then serializes
+func (errs Errors) MarshalJSON() ([]byte, error) {
+	var tmpErrs struct {
+		Errors []Error `json:"errors,omitempty"`
+	}
+
+	for _, daErr := range errs {
+		var err Error
+
+		switch daErr := daErr.(type) {
+		case ErrorCode:
+			err = daErr.WithDetail(nil)
+		case Error:
+			err = daErr
+		default:
+			err = ErrorCodeUnknown.WithDetail(daErr)
+
+		}
+
+		// If the Error struct was setup and they forgot to set the
+		// Message field (meaning its "") then grab it from the ErrCode
+		msg := err.Message
+		if msg == "" {
+			msg = err.Code.Message()
+		}
+
+		tmpErrs.Errors = append(tmpErrs.Errors, Error{
+			Code:    err.Code,
+			Message: msg,
+			Detail:  err.Detail,
+		})
+	}
+
+	return json.Marshal(tmpErrs)
+}
+
+// UnmarshalJSON deserializes []Error and then converts it into slice of
+// Error or ErrorCode
+func (errs *Errors) UnmarshalJSON(data []byte) error {
+	var tmpErrs struct {
+		Errors []Error
+	}
+
+	if err := json.Unmarshal(data, &tmpErrs); err != nil {
+		return err
+	}
+
+	var newErrs Errors
+	for _, daErr := range tmpErrs.Errors {
+		// If Message is empty or exactly matches the Code's message string
+		// then just use the Code, no need for a full Error struct
+		if daErr.Detail == nil && (daErr.Message == "" || daErr.Message == daErr.Code.Message()) {
+			// Error's w/o details get converted to ErrorCode
+			newErrs = append(newErrs, daErr.Code)
+		} else {
+			// Error's w/ details are untouched
+			newErrs = append(newErrs, Error{
+				Code:    daErr.Code,
+				Message: daErr.Message,
+				Detail:  daErr.Detail,
+			})
+		}
+	}
+
+	*errs = newErrs
+	return nil
+}
@@ -0,0 +1,40 @@
+package errcode
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+// ServeJSON attempts to serve the errcode in a JSON envelope. It marshals err
+// and sets the content-type header to 'application/json'. It will handle
+// ErrorCoder and Errors, and if necessary will create an envelope.
+func ServeJSON(w http.ResponseWriter, err error) error {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	var sc int
+
+	switch errs := err.(type) {
+	case Errors:
+		if len(errs) < 1 {
+			break
+		}
+
+		if err, ok := errs[0].(ErrorCoder); ok {
+			sc = err.ErrorCode().Descriptor().HTTPStatusCode
+		}
+	case ErrorCoder:
+		sc = errs.ErrorCode().Descriptor().HTTPStatusCode
+		err = Errors{err} // create an envelope.
+	default:
+		// We just have an unhandled error type, so just place in an envelope
+		// and move along.
+		err = Errors{err}
+	}
+
+	if sc == 0 {
+		sc = http.StatusInternalServerError
+	}
+
+	w.WriteHeader(sc)
+
+	return json.NewEncoder(w).Encode(err)
+}
@@ -0,0 +1,138 @@
+package errcode
+
+import (
+	"fmt"
+	"net/http"
+	"sort"
+	"sync"
+)
+
+var (
+	errorCodeToDescriptors = map[ErrorCode]ErrorDescriptor{}
+	idToDescriptors        = map[string]ErrorDescriptor{}
+	groupToDescriptors     = map[string][]ErrorDescriptor{}
+)
+
+var (
+	// ErrorCodeUnknown is a generic error that can be used as a last
+	// resort if there is no situation-specific error message that can be used
+	ErrorCodeUnknown = Register("errcode", ErrorDescriptor{
+		Value:   "UNKNOWN",
+		Message: "unknown error",
+		Description: `Generic error returned when the error does not have an
+			                                            API classification.`,
+		HTTPStatusCode: http.StatusInternalServerError,
+	})
+
+	// ErrorCodeUnsupported is returned when an operation is not supported.
+	ErrorCodeUnsupported = Register("errcode", ErrorDescriptor{
+		Value:   "UNSUPPORTED",
+		Message: "The operation is unsupported.",
+		Description: `The operation was unsupported due to a missing
+		implementation or invalid set of parameters.`,
+		HTTPStatusCode: http.StatusMethodNotAllowed,
+	})
+
+	// ErrorCodeUnauthorized is returned if a request requires
+	// authentication.
+	ErrorCodeUnauthorized = Register("errcode", ErrorDescriptor{
+		Value:   "UNAUTHORIZED",
+		Message: "authentication required",
+		Description: `The access controller was unable to authenticate
+		the client. Often this will be accompanied by a
+		Www-Authenticate HTTP response header indicating how to
+		authenticate.`,
+		HTTPStatusCode: http.StatusUnauthorized,
+	})
+
+	// ErrorCodeDenied is returned if a client does not have sufficient
+	// permission to perform an action.
+	ErrorCodeDenied = Register("errcode", ErrorDescriptor{
+		Value:   "DENIED",
+		Message: "requested access to the resource is denied",
+		Description: `The access controller denied access for the
+		operation on a resource.`,
+		HTTPStatusCode: http.StatusForbidden,
+	})
+
+	// ErrorCodeUnavailable provides a common error to report unavailability
+	// of a service or endpoint.
+	ErrorCodeUnavailable = Register("errcode", ErrorDescriptor{
+		Value:          "UNAVAILABLE",
+		Message:        "service unavailable",
+		Description:    "Returned when a service is not available",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	})
+
+	// ErrorCodeTooManyRequests is returned if a client attempts too many
+	// times to contact a service endpoint.
+	ErrorCodeTooManyRequests = Register("errcode", ErrorDescriptor{
+		Value:   "TOOMANYREQUESTS",
+		Message: "too many requests",
+		Description: `Returned when a client attempts to contact a
+		service too many times`,
+		HTTPStatusCode: http.StatusTooManyRequests,
+	})
+)
+
+var nextCode = 1000
+var registerLock sync.Mutex
+
+// Register will make the passed-in error known to the environment and
+// return a new ErrorCode
+func Register(group string, descriptor ErrorDescriptor) ErrorCode {
+	registerLock.Lock()
+	defer registerLock.Unlock()
+
+	descriptor.Code = ErrorCode(nextCode)
+
+	if _, ok := idToDescriptors[descriptor.Value]; ok {
+		panic(fmt.Sprintf("ErrorValue %q is already registered", descriptor.Value))
+	}
+	if _, ok := errorCodeToDescriptors[descriptor.Code]; ok {
+		panic(fmt.Sprintf("ErrorCode %v is already registered", descriptor.Code))
+	}
+
+	groupToDescriptors[group] = append(groupToDescriptors[group], descriptor)
+	errorCodeToDescriptors[descriptor.Code] = descriptor
+	idToDescriptors[descriptor.Value] = descriptor
+
+	nextCode++
+	return descriptor.Code
+}
+
+type byValue []ErrorDescriptor
+
+func (a byValue) Len() int           { return len(a) }
+func (a byValue) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+func (a byValue) Less(i, j int) bool { return a[i].Value < a[j].Value }
+
+// GetGroupNames returns the list of Error group names that are registered
+func GetGroupNames() []string {
+	keys := []string{}
+
+	for k := range groupToDescriptors {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// GetErrorCodeGroup returns the named group of error descriptors
+func GetErrorCodeGroup(name string) []ErrorDescriptor {
+	desc := groupToDescriptors[name]
+	sort.Sort(byValue(desc))
+	return desc
+}
+
+// GetErrorAllDescriptors returns a slice of all ErrorDescriptors that are
+// registered, irrespective of what group they're in
+func GetErrorAllDescriptors() []ErrorDescriptor {
+	result := []ErrorDescriptor{}
+
+	for _, group := range GetGroupNames() {
+		result = append(result, GetErrorCodeGroup(group)...)
+	}
+	sort.Sort(byValue(result))
+	return result
+}
@@ -1,16 +1,15 @@
 github.com/Azure/azure-sdk-for-go 4650843026a7fdec254a8d9cf893693a254edd0b
 github.com/Azure/go-autorest eaa7994b2278094c904d31993d26f56324db3052
 github.com/sirupsen/logrus 3d4380f53a34dcdc95f0c1db702615992b38d9a4
-github.com/aws/aws-sdk-go 5bcc0a238d880469f949fc7cd24e35f32ab80cbd
+github.com/aws/aws-sdk-go f831d5a0822a1ad72420ab18c6269bca1ddaf490
 github.com/bshuster-repo/logrus-logstash-hook d2c0ecc1836d91814e15e23bb5dc309c3ef51f4a
 github.com/beorn7/perks 4c0e84591b9aa9e6dcfdf3e020114cd81f89d5f9
 github.com/bugsnag/bugsnag-go b1d153021fcd90ca3f080db36bec96dc690fb274
 github.com/bugsnag/osext 0dd3f918b21bec95ace9dc86c7e70266cfc5c702
 github.com/bugsnag/panicwrap e2c28503fcd0675329da73bf48b33404db873782
-github.com/denverdino/aliyungo afedced274aa9a7fcdd47ac97018f0f8db4e5de2
+github.com/denverdino/aliyungo 6df11717a253d9c7d4141f9af4deaa7c580cd531
 github.com/dgrijalva/jwt-go a601269ab70c205d26370c16f7c81e9017c14e04
 github.com/docker/go-metrics 399ea8c73916000c64c2c76e8da00ca82f8387ab
-github.com/docker/goamz f0a21f5b2e12f83a505ecf79b633bb2035cf6f85
 github.com/docker/libtrust fa567046d9b14f6aa788882a950d69651d230b21
 github.com/garyburd/redigo 535138d7bcd717d6531c701ef5933d98b1866257
 github.com/go-ini/ini 2ba15ac2dc9cdf88c110ec2dc0ced7fa45f5678c
@@ -24,14 +23,14 @@ github.com/satori/go.uuid f58768cc1a7a7e77a3bd49e98cdd21419399b6a3
 github.com/matttproud/golang_protobuf_extensions c12348ce28de40eed0136aa2b644d0ee0650e56c
 github.com/miekg/dns 271c58e0c14f552178ea321a545ff9af38930f39
 github.com/mitchellh/mapstructure 482a9fd5fa83e8c4e7817413b80f3eb8feec03ef
-github.com/ncw/swift b964f2ca856aac39885e258ad25aec08d5f64ee6
+github.com/ncw/swift a0320860b16212c2b59b4912bb6508cda1d7cee6
 github.com/prometheus/client_golang c332b6f63c0658a65eca15c0e5247ded801cf564
 github.com/prometheus/client_model 99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c
 github.com/prometheus/common 89604d197083d4781071d3c65855d24ecfb0a563
 github.com/prometheus/procfs cb4147076ac75738c9a7d279075a253c0cc5acbd
+github.com/Shopify/logrus-bugsnag 577dee27f20dd8f1a529f82210094af593be12bd
 github.com/spf13/cobra 312092086bed4968099259622145a0c9ae280064
 github.com/spf13/pflag 5644820622454e71517561946e3d94b9f9db6842
-github.com/stevvooe/resumable 2aaf90b2ceea5072cb503ef2a620b08ff3119870
 github.com/xenolf/lego a9d8cec0e6563575e5868a005359ac97911b5985
 github.com/yvasiyarov/go-metrics 57bccd1ccd43f94bb17fdd8bf3007059b802f85e
 github.com/yvasiyarov/gorelic a9bba5b9ab508a086f9a12b8c51fab68478e2128
@@ -46,7 +45,7 @@ google.golang.org/cloud 975617b05ea8a58727e6c1a06b6161ff4185a9f2
 google.golang.org/grpc d3ddb4469d5a1b949fc7a7da7c1d6a0d1b6de994
 gopkg.in/check.v1 64131543e7896d5bcc6bd5a76287eb75ea96c673
 gopkg.in/square/go-jose.v1 40d457b439244b546f023d056628e5184136899b
-gopkg.in/yaml.v2 bef53efd0c76e49e6de55ead051f886bea7e9420
+gopkg.in/yaml.v2 v2.2.1
 rsc.io/letsencrypt e770c10b0f1a64775ae91d240407ce00d1a5bdeb https://github.com/dmcgowan/letsencrypt.git
 github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
 github.com/opencontainers/image-spec ab7389ef9f50030c9b245bc16b981c7ddf192882