We use the docker2aci library to fetch and squash a docker image into an
ACI when fetch or run is called with an URL like
docker://<docker registry URL>
Bump appc to 0.3.0+git. Until we reach v1.0.0, we are going to keep
Rocket releases trailing spec releases so the versioning is not too
confusing.
The reason for removing go-iptables is that nothing currently references
it, so Godep does not think it should be vendored: see
https://github.com/coreos/rocket/pull/470
It can be re-added when a package within Rocket uses it again.
Take two at getting the spec vendored into Rocket with Godep.
Since actool is used during the construction of the stage1.aci, it
really needs to be vendored too to prevent any unexpected divergence
between whatever version the user happens to have in their PATH. Thus,
we introduce a silly dummy package (stage1/dummy.go) to coerce Godep
into vendoring actool. This also requires a slight rearrangement of the
appc repo, moving some functionality from actool itself into the aci
package.
This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:
* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d
Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.
OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).
This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.
Fixes#215
This will allow us to take advantage of several new features like
`Import` (eliminating a copy from cas) and a "no cache" mode (to prevent
OOMs), as well as various bug fixes.
Iago López Galeiras