github.com/rkt/rkt@v1.30.1-0.20200224141603-171c416fac02/Documentation/subcommands/trust.md (about)

     1  # rkt trust
     2  
     3  Before executing a remotely fetched ACI, rkt will verify it based on attached signatures generated by the ACI creator.
     4  
     5  Before this can happen, rkt needs to know which creators you trust, and therefore are trusted to run images on your machine.
     6  The identity of each ACI creator is established with a public key, which is placed in rkt's key store on disk.
     7  
     8  When adding a trusted key, a prefix can scope the level of established trust to a subset of images.
     9  A few examples:
    10  
    11  ```
    12  # rkt trust --prefix=storage.coreos.com
    13  ```
    14  
    15  ```
    16  # rkt trust --prefix=coreos.com/etcd
    17  ```
    18  
    19  To trust a key for an entire root domain, you must use the `--root` flag, with a path to a key file (no discovery).
    20  
    21  ```
    22  # rkt trust --root ~/aci-pubkeys.gpg
    23  ```
    24  
    25  ## Trust a Key Using Meta Discovery
    26  
    27  The easiest way to trust a key is through meta discovery.
    28  rkt will find and download a public key that the creator has published on their website.
    29  The [ACI discovery mechanism is detailed in the App Container specification][appc-discovery].
    30  The TL;DR is rkt will find a meta tag that looks like:
    31  
    32  ```html
    33  <meta name="ac-discovery-pubkeys" content="coreos.com/etcd https://coreos.com/dist/pubkeys/aci-pubkeys.gpg">
    34  ```
    35  
    36  And use it to download the public key and present it to you for approval:
    37  
    38  ```
    39  # rkt trust --prefix=coreos.com/etcd
    40  Prefix: "coreos.com/etcd"
    41  Key: "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg"
    42  GPG key fingerprint is: 8B86 DE38 890D DB72 9186  7B02 5210 BD88 8818 2190
    43    CoreOS ACI Builder <release@coreos.com>
    44  Are you sure you want to trust this key (yes/no)? yes
    45  Trusting "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg" for prefix "coreos.com/etcd".
    46  Added key for prefix "coreos.com/etcd" at "/etc/rkt/trustedkeys/prefix.d/coreos.com/etcd/8b86de38890ddb7291867b025210bd8888182190"
    47  ```
    48  
    49  If rkt can't find a key using meta discovery, an error will be printed:
    50  
    51  ```
    52  # rkt trust --prefix=coreos.com
    53  Error determining key location: --prefix meta discovery error: found no ACI meta tags
    54  ```
    55  
    56  ## Trust a Key From Specific Location
    57  
    58  If you know where a public key is located, you can request it directly from disk or via HTTPS:
    59  
    60  ```
    61  # rkt trust --prefix=coreos.com/etcd https://coreos.com/dist/pubkeys/aci-pubkeys.gpg
    62  Prefix: "coreos.com/etcd"
    63  Key: "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg"
    64  GPG key fingerprint is: 8B86 DE38 890D DB72 9186  7B02 5210 BD88 8818 2190
    65    CoreOS ACI Builder <release@coreos.com>
    66  Are you sure you want to trust this key (yes/no)? yes
    67  Trusting "https://coreos.com/dist/pubkeys/aci-pubkeys.gpg" for prefix "coreos.com/etcd".
    68  Added key for prefix "coreos.com/etcd" at "/etc/rkt/trustedkeys/prefix.d/coreos.com/etcd/8b86de38890ddb7291867b025210bd8888182190"
    69  ```
    70  
    71  ## Pre-Populating Trusted Keys on Disk
    72  
    73  Trusted public keys can be pre-populated by placing them in the appropriate location on disk for the desired prefix.
    74  
    75  ```
    76  $ find /etc/rkt/trustedkeys/
    77  /etc/rkt/trustedkeys/
    78  /etc/rkt/trustedkeys/prefix.d
    79  /etc/rkt/trustedkeys/prefix.d/coreos.com
    80  /etc/rkt/trustedkeys/prefix.d/coreos.com/etcd
    81  /etc/rkt/trustedkeys/prefix.d/coreos.com/etcd/8b86de38890ddb7291867b025210bd8888182190
    82  /etc/rkt/trustedkeys/root.d
    83  /etc/rkt/trustedkeys/root.d/d8685c1eff3b2276e5da37fd65eea12767432ac4
    84  ```
    85  
    86  ## Options
    87  
    88  | Flag | Default | Options | Description |
    89  | --- | --- | --- | --- |
    90  | `--insecure-allow-http` |  `false` | `true` or `false` | Allow HTTP use for key discovery and/or retrieval |
    91  | `--prefix` |  `` | A URL prefix | Prefix to limit trust to |
    92  | `--root` |  `false` | `true` or `false` | Add root key from filesystem without a prefix |
    93  | `--skip-fingerprint-review` |  `false` | `true` or `false` | Accept key without fingerprint confirmation |
    94  
    95  ## Global options
    96  
    97  See the table with [global options in general commands documentation][global-options].
    98  
    99  
   100  [appc-discovery]: https://github.com/appc/spec/blob/master/spec/discovery.md
   101  [global-options]: ../commands.md#global-options