docker/libtrust — pull request #34 by dmcgowan (2014-09-29 21:13:27+00:00)
Title: Trust graph

Adds initial implementation for trust graph. This is intended to be the simplest possible implementation for delegating to different parts of the namespace. The primary use case is a key id being delegated to from a user namespace. This is a working implementation targeting Docker image provenance and intended to be flexible for further design and iteration.

Features
- One global namespace
- key ids are top level objects not under any namespace
- parts of the namespace are delimited by '/'
- users are under the default namespace "" (ie "/user1")
- All nodes automatically delegate to their parent with full permission
- All permissions are integer values which are checked through bit masking

Open questions
- Are more fine grained permissions needed
- Can key ids be associated to emails without invoking the default namespace
- Should there always be a top level namespace? (ie /keys/, /emails/, /docker/)

@shykes can you review the above, @jlhawn will be unavailable for review for a few weeks