{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/2033","labels_url":"https://api.github.com/repos/coreos/rkt/issues/2033/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2033/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/2033/events","html_url":"https://github.com/coreos/rkt/pull/2033","id":128596156,"number":2033,"title":"trust: only trust pubkeys on first use, prompt for https trust","user":{"login":"dgonyeo","id":2439413,"avatar_url":"https://avatars.githubusercontent.com/u/2439413?v=3","gravatar_id":"","url":"https://api.github.com/users/dgonyeo","html_url":"https://github.com/dgonyeo","followers_url":"https://api.github.com/users/dgonyeo/followers","following_url":"https://api.github.com/users/dgonyeo/following{/other_user}","gists_url":"https://api.github.com/users/dgonyeo/gists{/gist_id}","starred_url":"https://api.github.com/users/dgonyeo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgonyeo/subscriptions","organizations_url":"https://api.github.com/users/dgonyeo/orgs","repos_url":"https://api.github.com/users/dgonyeo/repos","events_url":"https://api.github.com/users/dgonyeo/events{/privacy}","received_events_url":"https://api.github.com/users/dgonyeo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/area/security","name":"area/security","color":"bfe5bf"},{"url":"https://api.github.com/repos/coreos/rkt/labels/component/stage0","name":"component/stage0","color":"0052cc"},{"url":"https://api.github.com/repos/coreos/rkt/labels/needs%20review","name":"needs review","color":"5319e7"},{"url":"https://api.github.com/repos/coreos/rkt/labels/priority/P1","name":"priority/P1","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-01-25T17:39:38Z","updated_at":"2016-01-26T13:23:31Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/2033","html_url":"https://github.com/coreos/rkt/pull/2033","diff_url":"https://github.com/coreos/rkt/pull/2033.diff","patch_url":"https://github.com/coreos/rkt/pull/2033.patch"},"body":"If rkt has a local public key for a given prefix, this commit makes it\r\nsuch that rkt will not automatically download and re-trust the key when\r\nan image for the prefix is run. In addition --trust-keys-from-https now\r\ndefaults to false, resulting in rkt prompting for the user to approve\r\nnew keys.\r\n\r\nA flag has been added to rkt trust that can be used to fetch and save\r\nnew keys for a given prefix when the key is expected to have changed.\r\n\r\nDefault behavior:\r\n```\r\n[nix-shell:~/go/src/github.com/coreos/rkt]$ sudo ./build-rkt-0.15.0/bin/rkt run aci.gonyeo.com/alpine --exec /bin/sh --interactive\r\nrkt: using image from local store for image name coreos.com/rkt/stage1-coreos:0.16.0+gitfe93264\r\nrkt: searching for app image aci.gonyeo.com/alpine\r\nrkt: remote fetching from URL \"https://aci.gonyeo.com/alpine-latest-linux-amd64.aci\"\r\nprefix: \"aci.gonyeo.com/alpine\"\r\nkey: \"https://aci.gonyeo.com/pubkeys.gpg\"\r\ngpg key fingerprint is: 391A 2660 3B7D 1A7B 969B  DB93 8D6A 284F 420B 2594\r\n    subkey fingerprint: 818A 735C A7D6 60F5 F113  8ED8 29A7 820C 14D5 7505\r\n\tDerek Gonyeo (ACI signing key) <derek@gonyeo.com>\r\nAre you sure you want to trust this key (yes/no)?\r\nno\r\nNot trusting \"https://aci.gonyeo.com/pubkeys.gpg\"\r\nrkt: downloading signature from https://aci.gonyeo.com/alpine-latest-linux-amd64.aci.asc\r\nDownloading signature: 473 B of an unknown total size\r\nrkt: If you expected the signing key to change, try running:\r\nrkt:     rkt trust --replace-keys --prefix <image>\r\nrun: openpgp: signature made by unknown entity\r\n```\r\n\r\nWith `--trust-keys-from-https`:\r\n```\r\n[nix-shell:~/go/src/github.com/coreos/rkt]$ sudo ./build-rkt-0.15.0/bin/rkt run aci.gonyeo.com/alpine --exec /bin/sh --interactive --trust-keys-from-https\r\nrkt: using image from local store for image name coreos.com/rkt/stage1-coreos:0.16.0+gitfe93264\r\nrkt: searching for app image aci.gonyeo.com/alpine\r\nrkt: remote fetching from URL \"https://aci.gonyeo.com/alpine-latest-linux-amd64.aci\"\r\nprefix: \"aci.gonyeo.com/alpine\"\r\nkey: \"https://aci.gonyeo.com/pubkeys.gpg\"\r\ngpg key fingerprint is: 391A 2660 3B7D 1A7B 969B  DB93 8D6A 284F 420B 2594\r\n    subkey fingerprint: 818A 735C A7D6 60F5 F113  8ED8 29A7 820C 14D5 7505\r\n\tDerek Gonyeo (ACI signing key) <derek@gonyeo.com>\r\nTrusting \"https://aci.gonyeo.com/pubkeys.gpg\" for prefix \"aci.gonyeo.com/alpine\" without fingerprint review.\r\nAdded key for prefix \"aci.gonyeo.com/alpine\" at \"/etc/rkt/trustedkeys/prefix.d/aci.gonyeo.com/alpine/391a26603b7d1a7b969bdb938d6a284f420b2594\"\r\nrkt: downloading signature from https://aci.gonyeo.com/alpine-latest-linux-amd64.aci.asc\r\nDownloading signature: 473 B of an unknown total size\r\nDownloading ACI: [=============================================] 2.49 MB/2.49 MB\r\nrkt: signature verified:\r\n  Derek Gonyeo (ACI signing key) <derek@gonyeo.com>\r\nWarning: libsystemd not found even though systemd is running. Cgroup limits set by the environment (e.g. a systemd service) won't be enforced.\r\nContinuing with per-app isolators disabled: could not determine if we're running from a unit file: unable to open a handle to libsystemd\r\n/ #\r\n```\r\n\r\nWhen a public key has changed:\r\n```\r\n[nix-shell:~/go/src/github.com/coreos/rkt]$ sudo ./build-rkt-0.15.0/bin/rkt run aci.gonyeo.com/alpine --exec /bin/sh --interactive\r\n[sudo] password for derek: \r\nrkt: using image from file /home/derek/go/src/github.com/coreos/rkt/build-rkt-0.15.0/bin/stage1-coreos.aci\r\nrkt: searching for app image aci.gonyeo.com/alpine\r\nrkt: remote fetching from URL \"https://aci.gonyeo.com/alpine-latest-linux-amd64.aci\"\r\nrkt: keys already exist for prefix \"aci.gonyeo.com/alpine\", not fetching again\r\nrkt: downloading signature from https://aci.gonyeo.com/alpine-latest-linux-amd64.aci.asc\r\nDownloading signature: 473 B of an unknown total size\r\nrkt: If you expected the signing key to change, try running:\r\nrkt:     rkt trust --replace-keys --prefix <image>\r\nrun: openpgp: signature made by unknown entity\r\n```\r\n\r\nDefault `rkt trust` behavior:\r\n```\r\n[nix-shell:~/go/src/github.com/coreos/rkt]$ sudo ./build-rkt-0.15.0/bin/rkt trust --prefix aci.gonyeo.com/alpine\r\nError adding keys: keys already set for prefix \"aci.gonyeo.com/alpine\"\r\n```\r\n\r\n`rkt trust` behavior when replacing a key:\r\n```\r\n[nix-shell:~/go/src/github.com/coreos/rkt]$ sudo ./build-rkt-0.15.0/bin/rkt trust --prefix aci.gonyeo.com/alpine --replace-keys\r\nKeys existed for prefix \"aci.gonyeo.com/alpine\", removing old keys\r\nprefix: \"aci.gonyeo.com/alpine\"\r\nkey: \"https://aci.gonyeo.com/pubkeys.gpg\"\r\ngpg key fingerprint is: 391A 2660 3B7D 1A7B 969B  DB93 8D6A 284F 420B 2594\r\n    subkey fingerprint: 818A 735C A7D6 60F5 F113  8ED8 29A7 820C 14D5 7505\r\n\tDerek Gonyeo (ACI signing key) <derek@gonyeo.com>\r\nAre you sure you want to trust this key (yes/no)?\r\nyes\r\nTrusting \"https://aci.gonyeo.com/pubkeys.gpg\" for prefix \"aci.gonyeo.com/alpine\" after fingerprint review.\r\nAdded key for prefix \"aci.gonyeo.com/alpine\" at \"/etc/rkt/trustedkeys/prefix.d/aci.gonyeo.com/alpine/391a26603b7d1a7b969bdb938d6a284f420b2594\"\r\n```"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/175008730","html_url":"https://github.com/coreos/rkt/pull/2033#issuecomment-175008730","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2033","id":175008730,"user":{"login":"krnowak","id":96081,"avatar_url":"https://avatars.githubusercontent.com/u/96081?v=3","gravatar_id":"","url":"https://api.github.com/users/krnowak","html_url":"https://github.com/krnowak","followers_url":"https://api.github.com/users/krnowak/followers","following_url":"https://api.github.com/users/krnowak/following{/other_user}","gists_url":"https://api.github.com/users/krnowak/gists{/gist_id}","starred_url":"https://api.github.com/users/krnowak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krnowak/subscriptions","organizations_url":"https://api.github.com/users/krnowak/orgs","repos_url":"https://api.github.com/users/krnowak/repos","events_url":"https://api.github.com/users/krnowak/events{/privacy}","received_events_url":"https://api.github.com/users/krnowak/received_events","type":"User","site_admin":false},"created_at":"2016-01-26T13:23:31Z","updated_at":"2016-01-26T13:23:31Z","body":"Nevermind, @alban already pointed that out.\r\n"}}