code: func GetPassphraseRetriever(in io.Reader, out io.Writer) notary.PassRetriever {
  	aliasMap := map[string]string{
  		"root":     "root",
  		"snapshot": "repository",
  		"targets":  "repository",
  		"default":  "repository",
  	}
  	baseRetriever := passphrase.PromptRetrieverWithInOut(in, out, aliasMap)
  	env := map[string]string{
  		"root":     os.Getenv("DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE"),
  		"snapshot": os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"),
  		"targets":  os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"),
  		"default":  os.Getenv("DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"),
  	}
  
  	return func(keyName string, alias string, createNew bool, numAttempts int) (string, bool, error) {
  		if v := env[alias]; v != "" {
  			return v, numAttempts > 1, nil
  		}
  		// For non-root roles, we can also try the "default" alias if it is specified
  		if v := env["default"]; v != "" && alias != data.CanonicalRootRole.String() {
  			return v, numAttempts > 1, nil
  		}
  		return baseRetriever(keyName, alias, createNew, numAttempts)
  	}
  }
docs: // GetPassphraseRetriever returns a passphrase retriever that utilizes Content Trust env vars