Currently rocket does not perform signature validation for ACI images.
Fix the issue by validating all ACI images during the initial download.
Example Usage:
```
$ sudo rkt run example.com/hello:0.0.1
rkt: starting to discover app img example.com/hello:0.0.1
...
rkt: example.com/hello:0.0.1 verified signed by:
Kelsey Hightower (ACI signing key) <kelsey.hightower@coreos.com>
```
This patch introduces a new global flag `-insecure-skip-verify`, which
disables signature validation for a single run.
```
$ sudo rkt -insecure-skip-verify run example.com/hello:0.0.1
...
```
This patch changes the behaviour of the fetch and run subcommands. By
default rocket will attempt to verify all ACI images and fail if the
detached signature is missing.
This patch also includes a new tutorial on how to sign, host, and verify
ACI images.
This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:
* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d
Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.
OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).
This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.
Fixes#215
Jonathan Boulle