13 files changed, 309 insertions, 25 deletions
diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go
index 53f4a8fa2..7086dc839 100644
--- a/cmd/podman/common/create.go
+++ b/cmd/podman/common/create.go
@@ -156,8 +156,7 @@ func GetCreateFlags(cf *ContainerCLIOpts) *pflag.FlagSet {
 	createFlags.String("entrypoint", "",
 		"Overwrite the default ENTRYPOINT of the image",
 	)
-	createFlags.StringArrayVarP(
-		&cf.env,
+	createFlags.StringArrayP(
 		"env", "e", containerConfig.Env(),
 		"Set environment variables in container",
 	)
diff --git a/cmd/podman/common/create_opts.go b/cmd/podman/common/create_opts.go
index c275b1674..8b38e3b47 100644
--- a/cmd/podman/common/create_opts.go
+++ b/cmd/podman/common/create_opts.go
@@ -32,7 +32,7 @@ type ContainerCLIOpts struct {
 	DeviceWriteBPs    []string
 	DeviceWriteIOPs   []string
 	Entrypoint        *string
-	env               []string
+	Env               []string
 	EnvHost           bool
 	EnvFile           []string
 	Expose            []string
diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go
index 3e9772576..ff7c39de2 100644
--- a/cmd/podman/common/specgen.go
+++ b/cmd/podman/common/specgen.go
@@ -335,15 +335,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
 		env = envLib.Join(env, fileEnv)
 	}
 
-	// env overrides any previous variables
-	if cmdLineEnv := c.env; len(cmdLineEnv) > 0 {
-		parsedEnv, err := envLib.ParseSlice(cmdLineEnv)
-		if err != nil {
-			return err
-		}
-		env = envLib.Join(env, parsedEnv)
+	parsedEnv, err := envLib.ParseSlice(c.Env)
+	if err != nil {
+		return err
 	}
-	s.Env = env
+
+	s.Env = envLib.Join(env, parsedEnv)
 
 	// LABEL VARIABLES
 	labels, err := parse.GetAllLabels(c.LabelFile, c.Label)
@@ -504,6 +501,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
 	s.CapDrop = c.CapDrop
 	s.Privileged = c.Privileged
 	s.ReadOnlyFilesystem = c.ReadOnly
+	s.ConmonPidFile = c.ConmonPIDFile
 
 	// TODO
 	// ouitside of specgen and oci though
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index 7927da04d..2ecdda2e0 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -55,6 +55,11 @@ func createFlags(flags *pflag.FlagSet) {
 	flags.AddFlagSet(common.GetCreateFlags(&cliVals))
 	flags.AddFlagSet(common.GetNetFlags())
 	flags.SetNormalizeFunc(common.AliasFlags)
+	if registry.IsRemote() {
+		_ = flags.MarkHidden("authfile")
+		_ = flags.MarkHidden("env-host")
+		_ = flags.MarkHidden("http-proxy")
+	}
 }
 
 func init() {
@@ -170,6 +175,13 @@ func createInit(c *cobra.Command) error {
 		val := c.Flag("entrypoint").Value.String()
 		cliVals.Entrypoint = &val
 	}
+	if c.Flags().Changed("env") {
+		env, err := c.Flags().GetStringArray("env")
+		if err != nil {
+			return errors.Wrapf(err, "retrieve env flag")
+		}
+		cliVals.Env = env
+	}
 
 	// Docker-compatibility: the "-h" flag for run/create is reserved for
 	// the hostname (see https://github.com/containers/libpod/issues/1367).
diff --git a/cmd/podman/containers/run.go b/cmd/podman/containers/run.go
index f72446cb6..5f3ea9ef4 100644
--- a/cmd/podman/containers/run.go
+++ b/cmd/podman/containers/run.go
@@ -60,6 +60,8 @@ func runFlags(flags *pflag.FlagSet) {
 	flags.BoolVar(&runRmi, "rmi", false, "Remove container image unless used by other containers")
 	if registry.IsRemote() {
 		_ = flags.MarkHidden("authfile")
+		_ = flags.MarkHidden("env-host")
+		_ = flags.MarkHidden("http-proxy")
 	}
 }
 func init() {
diff --git a/cmd/podman/images/trust.go b/cmd/podman/images/trust.go
new file mode 100644
index 000000000..88a567871
--- /dev/null
+++ b/cmd/podman/images/trust.go
@@ -0,0 +1,27 @@
+package images
+
+import (
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/cmd/podman/validate"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	trustDescription = `Manages which registries you trust as a source of container images based on their location.
+  The location is determined by the transport and the registry host of the image.  Using this container image docker://quay.io/podman/stable as an example, docker is the transport and quay.io is the registry host.`
+	trustCmd = &cobra.Command{
+		Use:   "trust",
+		Short: "Manage container image trust policy",
+		Long:  trustDescription,
+		RunE:  validate.SubCommandExists,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: trustCmd,
+		Parent:  imageCmd,
+	})
+}
diff --git a/cmd/podman/images/trust_set.go b/cmd/podman/images/trust_set.go
new file mode 100644
index 000000000..5868f5546
--- /dev/null
+++ b/cmd/podman/images/trust_set.go
@@ -0,0 +1,56 @@
+package images
+
+import (
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/libpod/image"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/containers/libpod/pkg/util"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	setTrustDescription = "Set default trust policy or add a new trust policy for a registry"
+	setTrustCommand     = &cobra.Command{
+		Use:     "set [flags] REGISTRY",
+		Short:   "Set default trust policy or a new trust policy for a registry",
+		Long:    setTrustDescription,
+		Example: "",
+		RunE:    setTrust,
+		Args:    cobra.ExactArgs(1),
+	}
+)
+
+var (
+	setOptions entities.SetTrustOptions
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: setTrustCommand,
+		Parent:  trustCmd,
+	})
+	setFlags := setTrustCommand.Flags()
+	setFlags.StringVar(&setOptions.PolicyPath, "policypath", "", "")
+	_ = setFlags.MarkHidden("policypath")
+	setFlags.StringSliceVarP(&setOptions.PubKeysFile, "pubkeysfile", "f", []string{}, `Path of installed public key(s) to trust for TARGET.
+Absolute path to keys is added to policy.json. May
+used multiple times to define multiple public keys.
+File(s) must exist before using this command`)
+	setFlags.StringVarP(&setOptions.Type, "type", "t", "signedBy", "Trust type, accept values: signedBy(default), accept, reject")
+}
+
+func setTrust(cmd *cobra.Command, args []string) error {
+	validTrustTypes := []string{"accept", "insecureAcceptAnything", "reject", "signedBy"}
+
+	valid, err := image.IsValidImageURI(args[0])
+	if err != nil || !valid {
+		return errors.Wrapf(err, "invalid image uri %s", args[0])
+	}
+
+	if !util.StringInSlice(setOptions.Type, validTrustTypes) {
+		return errors.Errorf("invalid choice: %s (choose from 'accept', 'reject', 'signedBy')", setOptions.Type)
+	}
+	return registry.ImageEngine().SetTrust(registry.Context(), args, setOptions)
+}
diff --git a/cmd/podman/images/trust_show.go b/cmd/podman/images/trust_show.go
new file mode 100644
index 000000000..23ee6c709
--- /dev/null
+++ b/cmd/podman/images/trust_show.go
@@ -0,0 +1,77 @@
+package images
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+	"text/template"
+
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	showTrustDescription = "Display trust policy for the system"
+	showTrustCommand     = &cobra.Command{
+		Use:     "show [flags] [REGISTRY]",
+		Short:   "Display trust policy for the system",
+		Long:    showTrustDescription,
+		RunE:    showTrust,
+		Example: "",
+	}
+)
+
+var (
+	showTrustOptions entities.ShowTrustOptions
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: showTrustCommand,
+		Parent:  trustCmd,
+	})
+	showFlags := showTrustCommand.Flags()
+	showFlags.BoolVarP(&showTrustOptions.JSON, "json", "j", false, "Output as json")
+	showFlags.StringVar(&showTrustOptions.PolicyPath, "policypath", "", "")
+	showFlags.BoolVar(&showTrustOptions.Raw, "raw", false, "Output raw policy file")
+	_ = showFlags.MarkHidden("policypath")
+	showFlags.StringVar(&showTrustOptions.RegistryPath, "registrypath", "", "")
+	_ = showFlags.MarkHidden("registrypath")
+
+}
+
+func showTrust(cmd *cobra.Command, args []string) error {
+	report, err := registry.ImageEngine().ShowTrust(registry.Context(), args, showTrustOptions)
+	if err != nil {
+		return err
+	}
+	if showTrustOptions.Raw {
+		fmt.Println(report.Raw)
+		return nil
+	}
+	if showTrustOptions.JSON {
+		b, err := json.MarshalIndent(report.Policies, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+		return nil
+	}
+
+	row := "{{.RepoName}}\t{{.Type}}\t{{.GPGId}}\t{{.SignatureStore}}\n"
+	format := "{{range . }}" + row + "{{end}}"
+	tmpl, err := template.New("listContainers").Parse(format)
+	if err != nil {
+		return err
+	}
+	w := tabwriter.NewWriter(os.Stdout, 8, 2, 2, ' ', 0)
+	if err := tmpl.Execute(w, report.Policies); err != nil {
+		return err
+	}
+	if err := w.Flush(); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/cmd/podman/login.go b/cmd/podman/login.go
index dc57758ab..8413861f5 100644
--- a/cmd/podman/login.go
+++ b/cmd/podman/login.go
@@ -8,6 +8,7 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/libpod/cmd/podman/registry"
 	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/containers/libpod/pkg/registries"
 	"github.com/spf13/cobra"
 )
 
@@ -23,7 +24,7 @@ var (
 		Short: "Login to a container registry",
 		Long:  "Login to a container registry on a specified server.",
 		RunE:  login,
-		Args:  cobra.ExactArgs(1),
+		Args:  cobra.MaximumNArgs(1),
 		Example: `podman login quay.io
   podman login --username ... --password ... quay.io
   podman login --authfile dir/auth.json quay.io`,
@@ -48,6 +49,7 @@ func init() {
 	flags.BoolVarP(&loginOptions.GetLoginSet, "get-login", "", false, "Return the current login user for the registry")
 	loginOptions.Stdin = os.Stdin
 	loginOptions.Stdout = os.Stdout
+	loginOptions.AcceptUnspecifiedRegistry = true
 }
 
 // Implementation of podman-login.
@@ -62,7 +64,8 @@ func login(cmd *cobra.Command, args []string) error {
 		AuthFilePath:                loginOptions.AuthFile,
 		DockerCertPath:              loginOptions.CertDir,
 		DockerInsecureSkipTLSVerify: skipTLS,
+		SystemRegistriesConfPath:    registries.SystemRegistriesConfPath(),
 	}
 	loginOptions.GetLoginSet = cmd.Flag("get-login").Changed
-	return auth.Login(context.Background(), &sysCtx, &loginOptions.LoginOptions, args[0])
+	return auth.Login(context.Background(), &sysCtx, &loginOptions.LoginOptions, args)
 }
diff --git a/cmd/podman/logout.go b/cmd/podman/logout.go
index c21711fc0..d0afc21b4 100644
--- a/cmd/podman/logout.go
+++ b/cmd/podman/logout.go
@@ -7,7 +7,7 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/libpod/cmd/podman/registry"
 	"github.com/containers/libpod/pkg/domain/entities"
-	"github.com/pkg/errors"
+	"github.com/containers/libpod/pkg/registries"
 	"github.com/spf13/cobra"
 )
 
@@ -39,19 +39,14 @@ func init() {
 	flags.AddFlagSet(auth.GetLogoutFlags(&logoutOptions))
 	logoutOptions.Stdin = os.Stdin
 	logoutOptions.Stdout = os.Stdout
+	logoutOptions.AcceptUnspecifiedRegistry = true
 }
 
 // Implementation of podman-logout.
 func logout(cmd *cobra.Command, args []string) error {
-	sysCtx := types.SystemContext{AuthFilePath: logoutOptions.AuthFile}
-
-	registry := ""
-	if len(args) > 0 {
-		if logoutOptions.All {
-			return errors.New("--all takes no arguments")
-		}
-		registry = args[0]
+	sysCtx := types.SystemContext{
+		AuthFilePath:             logoutOptions.AuthFile,
+		SystemRegistriesConfPath: registries.SystemRegistriesConfPath(),
 	}
-
-	return auth.Logout(&sysCtx, &logoutOptions, registry)
+	return auth.Logout(&sysCtx, &logoutOptions, args)
 }
diff --git a/cmd/podman/manifest/manifest.go b/cmd/podman/manifest/manifest.go
index 88d264c1f..d7f042a56 100644
--- a/cmd/podman/manifest/manifest.go
+++ b/cmd/podman/manifest/manifest.go
@@ -18,7 +18,9 @@ var (
 		Example: `podman manifest add mylist:v1.11 image:v1.11-amd64
   podman manifest create localhost/list
   podman manifest inspect localhost/list
-  podman manifest annotate --annotation left=right mylist:v1.11 image:v1.11-amd64`,
+  podman manifest annotate --annotation left=right mylist:v1.11 image:v1.11-amd64
+  podman manifest push mylist:v1.11 quay.io/myimagelist
+  podman manifest remove mylist:v1.11 sha256:15352d97781ffdf357bf3459c037be3efac4133dc9070c2dce7eca7c05c3e736`,
 	}
 )
 
diff --git a/cmd/podman/manifest/push.go b/cmd/podman/manifest/push.go
new file mode 100644
index 000000000..49c76f40b
--- /dev/null
+++ b/cmd/podman/manifest/push.go
@@ -0,0 +1,66 @@
+package manifest
+
+import (
+	"context"
+
+	"github.com/containers/common/pkg/auth"
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	manifestPushOpts = entities.ManifestPushOptions{}
+	pushCmd          = &cobra.Command{
+		Use:     "push [flags] SOURCE DESTINATION",
+		Short:   "Push a manifest list or image index to a registry",
+		Long:    "Pushes manifest lists and image indexes to registries.",
+		RunE:    push,
+		Example: `podman manifest push mylist:v1.11 quay.io/myimagelist`,
+		Args:    cobra.ExactArgs(2),
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: pushCmd,
+		Parent:  manifestCmd,
+	})
+	flags := pushCmd.Flags()
+	flags.BoolVar(&manifestPushOpts.Purge, "purge", false, "remove the manifest list if push succeeds")
+	flags.BoolVar(&manifestPushOpts.All, "all", false, "also push the images in the list")
+	flags.StringVar(&manifestPushOpts.Authfile, "authfile", auth.GetDefaultAuthFile(), "path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
+	flags.StringVar(&manifestPushOpts.CertDir, "cert-dir", "", "use certificates at the specified path to access the registry")
+	flags.StringVar(&manifestPushOpts.Creds, "creds", "", "use `[username[:password]]` for accessing the registry")
+	flags.StringVar(&manifestPushOpts.DigestFile, "digestfile", "", "after copying the image, write the digest of the resulting digest to the file")
+	flags.StringVarP(&manifestPushOpts.Format, "format", "f", "", "manifest type (oci or v2s2) to attempt to use when pushing the manifest list (default is manifest type of source)")
+	flags.BoolVarP(&manifestPushOpts.RemoveSignatures, "remove-signatures", "", false, "don't copy signatures when pushing images")
+	flags.StringVar(&manifestPushOpts.SignBy, "sign-by", "", "sign the image using a GPG key with the specified `FINGERPRINT`")
+	flags.BoolVar(&manifestPushOpts.TlsVerify, "tls-verify", true, "require HTTPS and verify certificates when accessing the registry")
+	flags.BoolVarP(&manifestPushOpts.Quiet, "quiet", "q", false, "don't output progress information when pushing lists")
+	if registry.IsRemote() {
+		_ = flags.MarkHidden("authfile")
+		_ = flags.MarkHidden("cert-dir")
+		_ = flags.MarkHidden("tls-verify")
+	}
+}
+
+func push(cmd *cobra.Command, args []string) error {
+	if err := auth.CheckAuthFile(manifestPushOpts.Authfile); err != nil {
+		return err
+	}
+	listImageSpec := args[0]
+	destSpec := args[1]
+	if listImageSpec == "" {
+		return errors.Errorf(`invalid image name "%s"`, listImageSpec)
+	}
+	if destSpec == "" {
+		return errors.Errorf(`invalid destination "%s"`, destSpec)
+	}
+	if err := registry.ImageEngine().ManifestPush(context.Background(), args, manifestPushOpts); err != nil {
+		return errors.Wrapf(err, "error pushing manifest %s to %s", listImageSpec, destSpec)
+	}
+	return nil
+}
diff --git a/cmd/podman/manifest/remove.go b/cmd/podman/manifest/remove.go
new file mode 100644
index 000000000..4d345efc0
--- /dev/null
+++ b/cmd/podman/manifest/remove.go
@@ -0,0 +1,47 @@
+package manifest
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	removeCmd = &cobra.Command{
+		Use:     "remove [flags] LIST IMAGE",
+		Short:   "Remove an entry from a manifest list or image index",
+		Long:    "Removes an image from a manifest list or image index.",
+		RunE:    remove,
+		Example: `podman manifest remove mylist:v1.11 sha256:15352d97781ffdf357bf3459c037be3efac4133dc9070c2dce7eca7c05c3e736`,
+		Args:    cobra.ExactArgs(2),
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: removeCmd,
+		Parent:  manifestCmd,
+	})
+}
+
+func remove(cmd *cobra.Command, args []string) error {
+	listImageSpec := args[0]
+	instanceSpec := args[1]
+	if listImageSpec == "" {
+		return errors.Errorf(`invalid image name "%s"`, listImageSpec)
+	}
+	if instanceSpec == "" {
+		return errors.Errorf(`invalid image digest "%s"`, instanceSpec)
+	}
+	updatedListID, err := registry.ImageEngine().ManifestRemove(context.Background(), args)
+	if err != nil {
+		return errors.Wrapf(err, "error removing from manifest list %s", listImageSpec)
+	}
+	fmt.Printf("%s\n", updatedListID)
+	return nil
+}