Support persistence of multiple keys

[SteveLasker]

The current nv2 client persists the keys at:
/home/[user]/.docker/nv2/sha256/[image-digest].jwt

This means if we have 2 or more keys, they'll override them.

What we'd like to support is:

docker pull registry.wabbit-networks.io/net-monitor:v1
docker tag registry.wabbit-networks.io/net-monitor:v1 registry.acme-rockets.io/net-monitor:v1
# some validation of the image
docker notary sign \
    --key ./wabbit-networks.key \
    --cert ./wabbit-networks.crt \
    registry.acme-rockets.io/net-monitor:v1
docker push registry.acme-rockets.io/net-monitor:v1

In the above case, there are 2 signatures on registry.wabbit-networks.io/net-monitor:v1, as it was re-signed after some validation, and pushed to registry.acme-rockets.io/net-monitor:v1, Both signatures should be pushed.

[shizhMSFT]

With #52, docker notary sign can sign the same manifest multiple times to different signature files, and save them under ~/.docker/nv2.

~/.docker/nv2$ tree
.
└── sha256
    └── 410a07f17151ffffb513f942a01748dfdb921de915ea6427d61d60b0357c1dcd
        └── sha256
            ├── 80e74537c8befc8a7887b0c4970f903b8495e254a92978588b27ba9403cdc655.jwt
            └── fe194016156fa082713a6e8830e21e6e1792c5320bfc39ec1695b2ce41287737.jwt

The output of docker push pushing the image with multiple signatures looks like

$ docker push 127.0.0.1:5000/busybox
Using default tag: latest
The push refers to repository [127.0.0.1:5000/busybox]
2983725f2649: Preparing
2983725f2649: Layer already exists
latest: digest: sha256:410a07f17151ffffb513f942a01748dfdb921de915ea6427d61d60b0357c1dcd size: 527
Pushing signature
signature manifest digest: sha256:a36ec01ec946fcaca16fa1c27b41dea8a5c1b7c41be5d219a18a1f67f1697f39 size: 470
signature manifest digest: sha256:5333d9a27a8f94da3f374ef6c74196024f9c317fa613d97ec713cc465b49ca9a size: 470

[shizhMSFT]

@SteveLasker Before completing your scenario, which signature should be stored when you do docker pull? All the sigantures? or the valid one?

[SteveLasker]

I’d suggest all, as pull may get gated by a specific signature, but we want to enable pull & push to copy all signatures. Is that what we’re doing now?

[shizhMSFT]

I’d suggest all, as pull may get gated by a specific signature, but we want to enable pull & push to copy all signatures. Is that what we’re doing now?

#54 does it.