anchor.diff:        org.label-schema.version=$VAULT_VERSION \
         org.label-schema.description="Vault secure production ready Docker image"
   
  -# Download Bifurcate
  -RUN apk -q --no-cache add ca-certificates curl gnupg wget &&\
  +WORKDIR /tmp
  +RUN	apk -q --no-cache add ca-certificates curl gnupg wget &&\
  +# Download Vault binary & integrity file
   	gpg --keyserver pgp.mit.edu --recv-keys 91A6E7F85D05C65630BEF18951852D87348FFC4C &&\
  -	wget -nv --progress=bar:force --show-progress https://github.com/novilabs/bifurcate/releases/download/v${BIFURCATE_VERSION}/bifurcate_${BIFURCATE_VERSION}_linux_amd64.tar.gz &&\
  -# Download Vault binary & integrity file
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip &&\
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS &&\
   	wget -nv --progress=bar:force --show-progress https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS.sig &&\
  -# Install Bifurcate, Vault
  -	tar xzf bifurcate_${BIFURCATE_VERSION}_linux_amd64.tar.gz -C /usr/local/bin/ &&\
  +# Install Vault
   	gpg --batch --verify vault_${VAULT_VERSION}_SHA256SUMS.sig vault_${VAULT_VERSION}_SHA256SUMS &&\
   	grep "linux_amd64.zip" vault_${VAULT_VERSION}_SHA256SUMS | sha256sum -sc &&\
   	unzip -q -o vault_${VAULT_VERSION}_linux_amd64.zip -d /usr/local/bin/ &&\
  
positive.code: # Create Vault user & group and add root to the vault group
  	addgroup -S vault &&\
  	adduser -H -h /tmp -D -S -G vault -g 'Vault user' -s /dev/null -D vault &&\
  	adduser vault consul &&\
  	adduser root vault &&\
  # Cleanup
  	apk -q --no-cache del --purge ca-certificates gnupg wget &&\
  	rm -rf vault_${VAULT_VERSION}_* bifurcate_${BIFURCATE_VERSION}_linux_amd64.tar.gz /root/.gnupg
  
  # Copy binaries. bin directory contains start_vault.sh vault-health.sh and consul-cli
  COPY bin/ /usr/local/bin
  # Copy /etc (Vault config, Bifurcate config)
  COPY etc/ /etc
  # Copy client certificates
  COPY client_certificate.* /etc/tls/
  
  RUN chown -R vault: /etc/vault &&\
  	chmod 660 /etc/vault/config.json &&\
  	cat /etc/tls/ca.pem >> /etc/ssl/certs/ca-certificates.crt
  
  
negative.code: MAINTAINER Miguel Terron <miguel.a.terron@gmail.com>
  
  ARG BUILD_DATE
  ARG	VCS_REF
  ARG	HASHICORP_PGP_KEY=51852D87348FFC4C
  ARG	VAULT_VERSION=0.10.0
  
  LABEL org.label-schema.build-date=$BUILD_DATE \
        org.label-schema.vcs-url="https://github.com/mterron/vault.git" \
  