{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/rocket/pulls/comments/22745616","id":22745616,"diff_hunk":"@@ -0,0 +1,265 @@\n+# Signing and Verification Guide\n+\n+This guide will walk you through signing, distributing, and verifying the hello ACI created in the [getting started guide](getting-started-guide.md).\n+\n+```\n+hello-0.0.1-linux-amd64.aci\n+```\n+\n+* [Signing ACI images](#signing-aci-images)\n+* [Distributing Images via Meta Discovery](#distributing-images-via-meta-discovery)\n+* [Verifying Images with Rocket](#verifying-images-with-rocket)\n+  * [Establishing Trust](#establishing-trust)\n+  * [Example Usage](#example-usage)\n+\n+## Signing ACI Images\n+\n+### Generate a gpg signing key\n+\n+Create a file named `gpg-batch`\n+\n+```\n+%echo Generating a default key\n+Key-Type: default\n+Subkey-Type: default\n+Name-Real: Kelsey Hightower\n+Name-Comment: ACI signing key\n+Name-Email: kelsey.hightower@coreos.com\n+Expire-Date: 0\n+Passphrase: rocket\n+%pubring rocket.pub\n+%secring rocket.sec\n+%commit\n+%echo done\n+```\n+\n+#### Generate the key using batch mode\n+\n+```\n+$ gpg2 --batch --gen-key gpg-batch\n+```\n+\n+#### List the keys\n+\n+```\n+$ gpg2 --no-default-keyring --secret-keyring ./rocket.sec --keyring ./rocket.pub --list-keys\n+```\n+```\n+./rocket.pub\n+------------\n+pub   2048R/26EF7A14 2015-01-09\n+uid       [ unknown] Kelsey Hightower (ACI signing key) <kelsey.hightower@coreos.com>\n+sub   2048R/B9C074CD 2015-01-09\n+```\n+\n+#### Export the public key\n+\n+```\n+$ gpg2 --no-default-keyring --armor \\\n+--secret-keyring ./rocket.sec --keyring ./rocket.pub \\\n+--output pubkeys.gpg \\\n+--export \"<kelsey.hightower@coreos.com>\"\n+```\n+\n+### Sign the image\n+\n+```\n+$ gpg2 --no-default-keyring --armor \\\n+--secret-keyring ./rocket.sec --keyring ./rocket.pub \\\n+--output hello-0.0.1-linux-amd64.sig \\\n+--detach-sig hello-0.0.1-linux-amd64.aci\n+```\n+\n+#### Verify the image using gpg2\n+\n+```\n+$ gpg2 --no-default-keyring \\\n+--secret-keyring ./rocket.sec --keyring ./rocket.pub \\\n+--verify hello-0.0.1-linux-amd64.sig hello-0.0.1-linux-amd64.aci\n+```\n+```\n+gpg: Signature made Fri Jan  9 05:01:49 2015 PST using RSA key ID 26EF7A14\n+gpg: Good signature from \"Kelsey Hightower (ACI signing key) <kelsey.hightower@coreos.com>\" [unknown]\n+gpg: WARNING: This key is not certified with a trusted signature!\n+gpg:          There is no indication that the signature belongs to the owner.\n+Primary key fingerprint: B346 E31D E7E3 C6F9 D1D4  603F 4DFB 61BF 26EF 7A14\n+```\n+\n+At this point you should have the following three files:\n+\n+* hello-0.0.1-linux-amd64.sig\n+* hello-0.0.1-linux-amd64.aci\n+* pubkeys.gpg\n+\n+## Distributing Images via Meta Discovery\n+\n+Host an HTML page with the following meta tags:\n+\n+```\n+<!DOCTYPE html>\n+<html lang=\"en\">\n+  <head>\n+    <meta charset=\"utf-8\">\n+    <meta name=\"ac-discovery\" content=\"example.com/hello https://example.com/images/{name}-{version}-{os}-{arch}.{ext}\">\n+    <meta name=\"ac-discovery-pubkeys\" content=\"example.com/hello https://example.com/pubkeys.gpg\">\n+  <head>\n+<html>\n+```\n+\n+Serve the following files at the locations described in the meta tags:\n+\n+* hello-0.0.1-linux-amd64.sig\n+* hello-0.0.1-linux-amd64.aci\n+* pubkeys.gpg\n+\n+### Rocket Integration\n+\n+Lets walk through the steps rocket takes when installing images using Meta Discovery.","path":"Documentation/signing-and-verification-guide.md","position":117,"original_position":117,"commit_id":"d01fe02dedd399a5a87f6aa05bb51dbe4890a447","original_commit_id":"d01fe02dedd399a5a87f6aa05bb51dbe4890a447","user":{"login":"jonboulle","id":2601015,"avatar_url":"https://avatars.githubusercontent.com/u/2601015?v=3","gravatar_id":"","url":"https://api.github.com/users/jonboulle","html_url":"https://github.com/jonboulle","followers_url":"https://api.github.com/users/jonboulle/followers","following_url":"https://api.github.com/users/jonboulle/following{/other_user}","gists_url":"https://api.github.com/users/jonboulle/gists{/gist_id}","starred_url":"https://api.github.com/users/jonboulle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonboulle/subscriptions","organizations_url":"https://api.github.com/users/jonboulle/orgs","repos_url":"https://api.github.com/users/jonboulle/repos","events_url":"https://api.github.com/users/jonboulle/events{/privacy}","received_events_url":"https://api.github.com/users/jonboulle/received_events","type":"User","site_admin":false},"body":"Let's\r\ns#installing#fetching#","created_at":"2015-01-09T21:48:20Z","updated_at":"2015-01-09T21:48:20Z","html_url":"https://github.com/coreos/rocket/pull/335#discussion_r22745616","pull_request_url":"https://api.github.com/repos/coreos/rocket/pulls/335","_links":{"self":{"href":"https://api.github.com/repos/coreos/rocket/pulls/comments/22745616"},"html":{"href":"https://github.com/coreos/rocket/pull/335#discussion_r22745616"},"pull_request":{"href":"https://api.github.com/repos/coreos/rocket/pulls/335"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/rocket/pulls/335","id":26991179,"html_url":"https://github.com/coreos/rocket/pull/335","diff_url":"https://github.com/coreos/rocket/pull/335.diff","patch_url":"https://github.com/coreos/rocket/pull/335.patch","issue_url":"https://api.github.com/repos/coreos/rocket/issues/335","number":335,"state":"open","locked":false,"title":"fetch: add signature validation","user":{"login":"kelseyhightower","id":1123322,"avatar_url":"https://avatars.githubusercontent.com/u/1123322?v=3","gravatar_id":"","url":"https://api.github.com/users/kelseyhightower","html_url":"https://github.com/kelseyhightower","followers_url":"https://api.github.com/users/kelseyhightower/followers","following_url":"https://api.github.com/users/kelseyhightower/following{/other_user}","gists_url":"https://api.github.com/users/kelseyhightower/gists{/gist_id}","starred_url":"https://api.github.com/users/kelseyhightower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kelseyhightower/subscriptions","organizations_url":"https://api.github.com/users/kelseyhightower/orgs","repos_url":"https://api.github.com/users/kelseyhightower/repos","events_url":"https://api.github.com/users/kelseyhightower/events{/privacy}","received_events_url":"https://api.github.com/users/kelseyhightower/received_events","type":"User","site_admin":false},"body":"Currently rocket does not perform signature validation for ACI images.\r\n\r\nFix the issue by validating all ACI images during the initial download.\r\n\r\nExample Usage:\r\n\r\n```\r\n$ sudo rkt run example.com/hello:0.0.1\r\nrkt: starting to discover app img example.com/hello:0.0.1\r\n...\r\nrkt: example.com/hello:0.0.1 verified signed by:\r\n  Kelsey Hightower (ACI signing key) <kelsey.hightower@coreos.com>\r\n```\r\n\r\nThis patch introduces a new global flag `-insecure-skip-verify`, which\r\ndisables signature validation for a single run.\r\n\r\n```\r\n$ sudo rkt -insecure-skip-verify run example.com/hello:0.0.1\r\n...\r\n```\r\n\r\nThis patch changes the behaviour of the fetch and run subcommands. By\r\ndefault rocket will attempt to verify all ACI images and fail if the\r\ndetached signature is missing.\r\n\r\nThis patch also includes a new tutorial on how to sign, host, and verify\r\nACI images.","created_at":"2015-01-07T21:59:34Z","updated_at":"2015-01-09T21:48:20Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f0dbe0ca306797eb410c6bd16fda82cb4e405eda","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/coreos/rocket/pulls/335/commits","review_comments_url":"https://api.github.com/repos/coreos/rocket/pulls/335/comments","review_comment_url":"https://api.github.com/repos/coreos/rocket/pulls/comments/{number}","comments_url":"https://api.github.com/repos/coreos/rocket/issues/335/comments","statuses_url":"https://api.github.com/repos/coreos/rocket/statuses/d01fe02dedd399a5a87f6aa05bb51dbe4890a447","head":{"label":"kelseyhightower:add-encryption-and-verification","ref":"add-encryption-and-verification","sha":"d01fe02dedd399a5a87f6aa05bb51dbe4890a447","user":{"login":"kelseyhightower","id":1123322,"avatar_url":"https://avatars.githubusercontent.com/u/1123322?v=3","gravatar_id":"","url":"https://api.github.com/users/kelseyhightower","html_url":"https://github.com/kelseyhightower","followers_url":"https://api.github.com/users/kelseyhightower/followers","following_url":"https://api.github.com/users/kelseyhightower/following{/other_user}","gists_url":"https://api.github.com/users/kelseyhightower/gists{/gist_id}","starred_url":"https://api.github.com/users/kelseyhightower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kelseyhightower/subscriptions","organizations_url":"https://api.github.com/users/kelseyhightower/orgs","repos_url":"https://api.github.com/users/kelseyhightower/repos","events_url":"https://api.github.com/users/kelseyhightower/events{/privacy}","received_events_url":"https://api.github.com/users/kelseyhightower/received_events","type":"User","site_admin":false},"repo":{"id":27601189,"name":"rocket","full_name":"kelseyhightower/rocket","owner":{"login":"kelseyhightower","id":1123322,"avatar_url":"https://avatars.githubusercontent.com/u/1123322?v=3","gravatar_id":"","url":"https://api.github.com/users/kelseyhightower","html_url":"https://github.com/kelseyhightower","followers_url":"https://api.github.com/users/kelseyhightower/followers","following_url":"https://api.github.com/users/kelseyhightower/following{/other_user}","gists_url":"https://api.github.com/users/kelseyhightower/gists{/gist_id}","starred_url":"https://api.github.com/users/kelseyhightower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kelseyhightower/subscriptions","organizations_url":"https://api.github.com/users/kelseyhightower/orgs","repos_url":"https://api.github.com/users/kelseyhightower/repos","events_url":"https://api.github.com/users/kelseyhightower/events{/privacy}","received_events_url":"https://api.github.com/users/kelseyhightower/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kelseyhightower/rocket","description":"App Container runtime","fork":true,"url":"https://api.github.com/repos/kelseyhightower/rocket","forks_url":"https://api.github.com/repos/kelseyhightower/rocket/forks","keys_url":"https://api.github.com/repos/kelseyhightower/rocket/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kelseyhightower/rocket/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kelseyhightower/rocket/teams","hooks_url":"https://api.github.com/repos/kelseyhightower/rocket/hooks","issue_events_url":"https://api.github.com/repos/kelseyhightower/rocket/issues/events{/number}","events_url":"https://api.github.com/repos/kelseyhightower/rocket/events","assignees_url":"https://api.github.com/repos/kelseyhightower/rocket/assignees{/user}","branches_url":"https://api.github.com/repos/kelseyhightower/rocket/branches{/branch}","tags_url":"https://api.github.com/repos/kelseyhightower/rocket/tags","blobs_url":"https://api.github.com/repos/kelseyhightower/rocket/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kelseyhightower/rocket/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kelseyhightower/rocket/git/refs{/sha}","trees_url":"https://api.github.com/repos/kelseyhightower/rocket/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kelseyhightower/rocket/statuses/{sha}","languages_url":"https://api.github.com/repos/kelseyhightower/rocket/languages","stargazers_url":"https://api.github.com/repos/kelseyhightower/rocket/stargazers","contributors_url":"https://api.github.com/repos/kelseyhightower/rocket/contributors","subscribers_url":"https://api.github.com/repos/kelseyhightower/rocket/subscribers","subscription_url":"https://api.github.com/repos/kelseyhightower/rocket/subscription","commits_url":"https://api.github.com/repos/kelseyhightower/rocket/commits{/sha}","git_commits_url":"https://api.github.com/repos/kelseyhightower/rocket/git/commits{/sha}","comments_url":"https://api.github.com/repos/kelseyhightower/rocket/comments{/number}","issue_comment_url":"https://api.github.com/repos/kelseyhightower/rocket/issues/comments/{number}","contents_url":"https://api.github.com/repos/kelseyhightower/rocket/contents/{+path}","compare_url":"https://api.github.com/repos/kelseyhightower/rocket/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kelseyhightower/rocket/merges","archive_url":"https://api.github.com/repos/kelseyhightower/rocket/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kelseyhightower/rocket/downloads","issues_url":"https://api.github.com/repos/kelseyhightower/rocket/issues{/number}","pulls_url":"https://api.github.com/repos/kelseyhightower/rocket/pulls{/number}","milestones_url":"https://api.github.com/repos/kelseyhightower/rocket/milestones{/number}","notifications_url":"https://api.github.com/repos/kelseyhightower/rocket/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kelseyhightower/rocket/labels{/name}","releases_url":"https://api.github.com/repos/kelseyhightower/rocket/releases{/id}","created_at":"2014-12-05T17:00:29Z","updated_at":"2015-01-08T20:33:00Z","pushed_at":"2015-01-09T19:54:09Z","git_url":"git://github.com/kelseyhightower/rocket.git","ssh_url":"git@github.com:kelseyhightower/rocket.git","clone_url":"https://github.com/kelseyhightower/rocket.git","svn_url":"https://github.com/kelseyhightower/rocket","homepage":"","size":1181,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"30d24642e22436242e5f66223d83f78ef82ee2ee","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":26509369,"name":"rocket","full_name":"coreos/rocket","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/rocket","description":"App Container runtime","fork":false,"url":"https://api.github.com/repos/coreos/rocket","forks_url":"https://api.github.com/repos/coreos/rocket/forks","keys_url":"https://api.github.com/repos/coreos/rocket/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/rocket/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/rocket/teams","hooks_url":"https://api.github.com/repos/coreos/rocket/hooks","issue_events_url":"https://api.github.com/repos/coreos/rocket/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/rocket/events","assignees_url":"https://api.github.com/repos/coreos/rocket/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/rocket/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/rocket/tags","blobs_url":"https://api.github.com/repos/coreos/rocket/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/rocket/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/rocket/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/rocket/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/rocket/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/rocket/languages","stargazers_url":"https://api.github.com/repos/coreos/rocket/stargazers","contributors_url":"https://api.github.com/repos/coreos/rocket/contributors","subscribers_url":"https://api.github.com/repos/coreos/rocket/subscribers","subscription_url":"https://api.github.com/repos/coreos/rocket/subscription","commits_url":"https://api.github.com/repos/coreos/rocket/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/rocket/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/rocket/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/rocket/issues/comments/{number}","contents_url":"https://api.github.com/repos/coreos/rocket/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/rocket/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/rocket/merges","archive_url":"https://api.github.com/repos/coreos/rocket/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/rocket/downloads","issues_url":"https://api.github.com/repos/coreos/rocket/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/rocket/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/rocket/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/rocket/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/rocket/labels{/name}","releases_url":"https://api.github.com/repos/coreos/rocket/releases{/id}","created_at":"2014-11-11T23:13:18Z","updated_at":"2015-01-09T18:22:37Z","pushed_at":"2015-01-09T18:22:37Z","git_url":"git://github.com/coreos/rocket.git","ssh_url":"git@github.com:coreos/rocket.git","clone_url":"https://github.com/coreos/rocket.git","svn_url":"https://github.com/coreos/rocket","homepage":"","size":4456,"stargazers_count":3099,"watchers_count":3099,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":210,"mirror_url":null,"open_issues_count":51,"forks":210,"open_issues":51,"watchers":3099,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/rocket/pulls/335"},"html":{"href":"https://github.com/coreos/rocket/pull/335"},"issue":{"href":"https://api.github.com/repos/coreos/rocket/issues/335"},"comments":{"href":"https://api.github.com/repos/coreos/rocket/issues/335/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/rocket/pulls/335/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/rocket/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/coreos/rocket/pulls/335/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/rocket/statuses/d01fe02dedd399a5a87f6aa05bb51dbe4890a447"}}}}