Use notary library for trusted image fetch and signing

Add a trusted flag to force the cli to resolve a tag into a digest via the notary trust library and pull by digest.
On push the flag the trust flag will indicate the digest and size of a manifest should be signed and push to a notary server.
If a tag is given, the cli will resolve the tag into a digest and pull by digest.
After pulling, if a tag is given the cli makes a request to tag the image.

Use certificate directory for notary requests

Read certificates using same logic used by daemon for registry requests.

Catch JSON syntax errors from Notary client

When an uncaught error occurs in Notary it may show up in Docker as a JSON syntax error, causing a confusing error message to the user.
Provide a generic error when a JSON syntax error occurs.

Catch expiration errors and wrap in additional context.

Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Upstream-commit: ed13c3abfb242905ec012e8255dc6f26dcf122f6
Component: engine

components/engine/integration-cli/docker_cli_by_digest_test.go

@@ -10,8 +10,9 @@ import (
 )
 
 var (
-	repoName    = fmt.Sprintf("%v/dockercli/busybox-by-dgst", privateRegistryURL)
-	digestRegex = regexp.MustCompile("Digest: ([^\n]+)")
+	repoName        = fmt.Sprintf("%v/dockercli/busybox-by-dgst", privateRegistryURL)
+	pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+")
+	digestRegex     = regexp.MustCompile("Digest: ([\\S]+)")
 )
 
 func setupImage(c *check.C) (string, error) {
@@ -45,8 +46,7 @@ func setupImageWithTag(c *check.C, tag string) (string, error) {
 		return "", fmt.Errorf("error deleting images prior to real test: %s, %v", rmiout, err)
 	}
 
-	// the push output includes "Digest: <digest>", so find that
-	matches := digestRegex.FindStringSubmatch(out)
+	matches := pushDigestRegex.FindStringSubmatch(out)
 	if len(matches) != 2 {
 		return "", fmt.Errorf("unable to parse digest from push output: %s", out)
 	}