Add an option to the notary client config file to point to folder/file for alternate trust root

[cyli]

This way root CAs do not have to be added to the system in order to test self-signed certificates.

This gets around having to change the client's system (in Mac OS, involves editing /System/Library/Keychains/SystemRootCertificates.keychain).

See https://golang.org/src/crypto/tls/common.go?#L235.

Notary already makes use of a config file as well as the tls config.

[glyph]

It's worth noting that changing the file at that path on the latest OS X release – El Capitan – requires rebooting into a recovery shell, so not something you can do as part of an automated dev environment setup. See Homebrew/legacy-homebrew#40837 (comment)

[diogomonica]

@cyli @glyph checkout #210

Added the ability of having notary-cli config being loaded through a cmd-line variable (or by default under ~/.notary/config.json), and I'm now allowing setting a root-ca file. This should remove the need for messing with Library Keychains for development and testing.

[glyph]

@diogomonica What would be really cool is if, rather than hard-coding the system keychain path, it extracted the current set of user-configured trust roots. Unfortunately this involves a complex series of Security.framework APIs I haven't quite figured out yet :). Maybe SecTrustCopyCustomAnchorCertificates?

[glyph]

@diogomonica (that is only really a solution for OS X though, I don't think there's a reasonable equivalent to Keychain Access on Linux)

[glyph]

Sorry, re-reading that, I think I wasn't very clear. What I meant to say is, configuring a trust root .pem path is cool, #210 is a good step, it's a necessary step for Linux regardless, but a better default than trusting the system keychain would be to trust the actual trust evaluation anchor set configured by the OS X platform, since users can add and remove trusted root certificates in the Keychain Access app (and also potentially via various Keychain APIs) that are per-user rather than system-wide; or, system-wide configured in /Library rather than /System/Library.

[cyli]

#210 got merged, s o closing this. Per-user trust roots can maybe be a different issue, since it's OS X specifically?