Support signed image metadata

Support signed image metadata

The simplestreams image metadata can be clear signed with a 
PGP signature. The public key to use to validate the signature
is copied from the Launchpad simplestreams project. For ec2
image metadata, signing is mandatory; for openstack it is optional.
Signed metadata is searched for first and used if found.

https://code.launchpad.net/~wallyworld/juju-core/signed-simplestreams/+merge/163824

Requires: https://code.launchpad.net/~wallyworld/juju-core/oxygen-image-metadata/+merge/163345

(do not edit description out of merge proposal)

[wallyworld, 2013-05-15 01:54:50]

Please take a look.

[wallyworld, 2013-05-16 01:12:38]

Please take a look.

[wallyworld, 2013-05-17 02:19:59]

Please take a look.

[fwereade, 2013-05-17 08:50:00]

LGTM, nice.

https://codereview.appspot.com/9419047/diff/5001/environs/imagemetadata/decod...
File environs/imagemetadata/decode.go (right):

https://codereview.appspot.com/9419047/diff/5001/environs/imagemetadata/decod...
environs/imagemetadata/decode.go:98: type NotPGPSigned struct{}
ErrNotPGPSigned please

https://codereview.appspot.com/9419047/diff/5001/environs/openstack/image.go
File environs/openstack/image.go (right):

https://codereview.appspot.com/9419047/diff/5001/environs/openstack/image.go#...
environs/openstack/image.go:42: // TODO (wallyworld): use an env parameter
(default true) to mandate use of only signed image metadata.
Long-term, FWIW, I think there's probably a case for moving
simplestreams-base-url and simplestreams-require-signature into environ config
-- some people do like custom images, even on EC2, and I think it's good to
expose it across the board. (Always some providers for whom it won't work,
though...)

[jameinel, 2013-05-21 12:01:43]

LGTM

[wallyworld, 2013-05-21 21:41:51]

https://codereview.appspot.com/9419047/diff/5001/environs/imagemetadata/decod...
File environs/imagemetadata/decode.go (right):

https://codereview.appspot.com/9419047/diff/5001/environs/imagemetadata/decod...
environs/imagemetadata/decode.go:98: type NotPGPSigned struct{}
On 2013/05/17 08:50:00, fwereade wrote:
> ErrNotPGPSigned please

Renamed to NotPGPSignedError to be consistent with the existing NotFoundError
etc

[wallyworld, 2013-05-22 23:52:53]

*** Submitted:

Support signed image metadata

The simplestreams image metadata can be clear signed with a 
PGP signature. The public key to use to validate the signature
is copied from the Launchpad simplestreams project. For ec2
image metadata, signing is mandatory; for openstack it is optional.
Signed metadata is searched for first and used if found.

R=fwereade, jameinel
CC=
https://codereview.appspot.com/9419047