There is nothing private about our collection of public keys. Make it
world-readable by default. This makes it possible to fetch containers as
non-root users.
if the Reader for the *.sig is without an armored signature, then the
returned error is just EOF. Not helpful.
Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
Currently rocket does not perform signature validation for ACI images.
Fix the issue by validating all ACI images during the initial download.
Example Usage:
```
$ sudo rkt run example.com/hello:0.0.1
rkt: starting to discover app img example.com/hello:0.0.1
...
rkt: example.com/hello:0.0.1 verified signed by:
Kelsey Hightower (ACI signing key) <kelsey.hightower@coreos.com>
```
This patch introduces a new global flag `-insecure-skip-verify`, which
disables signature validation for a single run.
```
$ sudo rkt -insecure-skip-verify run example.com/hello:0.0.1
...
```
This patch changes the behaviour of the fetch and run subcommands. By
default rocket will attempt to verify all ACI images and fail if the
detached signature is missing.
This patch also includes a new tutorial on how to sign, host, and verify
ACI images.
This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:
* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d
Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.
OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).
This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.
Fixes#215
Jonathan Boulle