3 files changed, 160 insertions, 0 deletions
diff --git a/cmd/podman/images/trust.go b/cmd/podman/images/trust.go
new file mode 100644
index 000000000..88a567871
--- /dev/null
+++ b/cmd/podman/images/trust.go
@@ -0,0 +1,27 @@
+package images
+
+import (
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/cmd/podman/validate"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	trustDescription = `Manages which registries you trust as a source of container images based on their location.
+  The location is determined by the transport and the registry host of the image.  Using this container image docker://quay.io/podman/stable as an example, docker is the transport and quay.io is the registry host.`
+	trustCmd = &cobra.Command{
+		Use:   "trust",
+		Short: "Manage container image trust policy",
+		Long:  trustDescription,
+		RunE:  validate.SubCommandExists,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: trustCmd,
+		Parent:  imageCmd,
+	})
+}
diff --git a/cmd/podman/images/trust_set.go b/cmd/podman/images/trust_set.go
new file mode 100644
index 000000000..5868f5546
--- /dev/null
+++ b/cmd/podman/images/trust_set.go
@@ -0,0 +1,56 @@
+package images
+
+import (
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/libpod/image"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/containers/libpod/pkg/util"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	setTrustDescription = "Set default trust policy or add a new trust policy for a registry"
+	setTrustCommand     = &cobra.Command{
+		Use:     "set [flags] REGISTRY",
+		Short:   "Set default trust policy or a new trust policy for a registry",
+		Long:    setTrustDescription,
+		Example: "",
+		RunE:    setTrust,
+		Args:    cobra.ExactArgs(1),
+	}
+)
+
+var (
+	setOptions entities.SetTrustOptions
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: setTrustCommand,
+		Parent:  trustCmd,
+	})
+	setFlags := setTrustCommand.Flags()
+	setFlags.StringVar(&setOptions.PolicyPath, "policypath", "", "")
+	_ = setFlags.MarkHidden("policypath")
+	setFlags.StringSliceVarP(&setOptions.PubKeysFile, "pubkeysfile", "f", []string{}, `Path of installed public key(s) to trust for TARGET.
+Absolute path to keys is added to policy.json. May
+used multiple times to define multiple public keys.
+File(s) must exist before using this command`)
+	setFlags.StringVarP(&setOptions.Type, "type", "t", "signedBy", "Trust type, accept values: signedBy(default), accept, reject")
+}
+
+func setTrust(cmd *cobra.Command, args []string) error {
+	validTrustTypes := []string{"accept", "insecureAcceptAnything", "reject", "signedBy"}
+
+	valid, err := image.IsValidImageURI(args[0])
+	if err != nil || !valid {
+		return errors.Wrapf(err, "invalid image uri %s", args[0])
+	}
+
+	if !util.StringInSlice(setOptions.Type, validTrustTypes) {
+		return errors.Errorf("invalid choice: %s (choose from 'accept', 'reject', 'signedBy')", setOptions.Type)
+	}
+	return registry.ImageEngine().SetTrust(registry.Context(), args, setOptions)
+}
diff --git a/cmd/podman/images/trust_show.go b/cmd/podman/images/trust_show.go
new file mode 100644
index 000000000..23ee6c709
--- /dev/null
+++ b/cmd/podman/images/trust_show.go
@@ -0,0 +1,77 @@
+package images
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+	"text/template"
+
+	"github.com/containers/libpod/cmd/podman/registry"
+	"github.com/containers/libpod/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	showTrustDescription = "Display trust policy for the system"
+	showTrustCommand     = &cobra.Command{
+		Use:     "show [flags] [REGISTRY]",
+		Short:   "Display trust policy for the system",
+		Long:    showTrustDescription,
+		RunE:    showTrust,
+		Example: "",
+	}
+)
+
+var (
+	showTrustOptions entities.ShowTrustOptions
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode},
+		Command: showTrustCommand,
+		Parent:  trustCmd,
+	})
+	showFlags := showTrustCommand.Flags()
+	showFlags.BoolVarP(&showTrustOptions.JSON, "json", "j", false, "Output as json")
+	showFlags.StringVar(&showTrustOptions.PolicyPath, "policypath", "", "")
+	showFlags.BoolVar(&showTrustOptions.Raw, "raw", false, "Output raw policy file")
+	_ = showFlags.MarkHidden("policypath")
+	showFlags.StringVar(&showTrustOptions.RegistryPath, "registrypath", "", "")
+	_ = showFlags.MarkHidden("registrypath")
+
+}
+
+func showTrust(cmd *cobra.Command, args []string) error {
+	report, err := registry.ImageEngine().ShowTrust(registry.Context(), args, showTrustOptions)
+	if err != nil {
+		return err
+	}
+	if showTrustOptions.Raw {
+		fmt.Println(report.Raw)
+		return nil
+	}
+	if showTrustOptions.JSON {
+		b, err := json.MarshalIndent(report.Policies, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+		return nil
+	}
+
+	row := "{{.RepoName}}\t{{.Type}}\t{{.GPGId}}\t{{.SignatureStore}}\n"
+	format := "{{range . }}" + row + "{{end}}"
+	tmpl, err := template.New("listContainers").Parse(format)
+	if err != nil {
+		return err
+	}
+	w := tabwriter.NewWriter(os.Stdout, 8, 2, 2, ' ', 0)
+	if err := tmpl.Execute(w, report.Policies); err != nil {
+		return err
+	}
+	if err := w.Flush(); err != nil {
+		return err
+	}
+	return nil
+}