{"action":"created","issue":{"url":"https://api.github.com/repos/linuxkit/linuxkit/issues/2068","repository_url":"https://api.github.com/repos/linuxkit/linuxkit","labels_url":"https://api.github.com/repos/linuxkit/linuxkit/issues/2068/labels{/name}","comments_url":"https://api.github.com/repos/linuxkit/linuxkit/issues/2068/comments","events_url":"https://api.github.com/repos/linuxkit/linuxkit/issues/2068/events","html_url":"https://github.com/linuxkit/linuxkit/pull/2068","id":236739664,"number":2068,"title":"Verify kernel with GPG and sha256 checksum","user":{"login":"mscribe","id":24819929,"avatar_url":"https://avatars3.githubusercontent.com/u/24819929?v=3","gravatar_id":"","url":"https://api.github.com/users/mscribe","html_url":"https://github.com/mscribe","followers_url":"https://api.github.com/users/mscribe/followers","following_url":"https://api.github.com/users/mscribe/following{/other_user}","gists_url":"https://api.github.com/users/mscribe/gists{/gist_id}","starred_url":"https://api.github.com/users/mscribe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mscribe/subscriptions","organizations_url":"https://api.github.com/users/mscribe/orgs","repos_url":"https://api.github.com/users/mscribe/repos","events_url":"https://api.github.com/users/mscribe/events{/privacy}","received_events_url":"https://api.github.com/users/mscribe/received_events","type":"User","site_admin":false},"labels":[{"id":572728714,"url":"https://api.github.com/repos/linuxkit/linuxkit/labels/status/0-triage","name":"status/0-triage","color":"eeeeee","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-06-18T19:14:44Z","updated_at":"2017-06-18T19:38:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/linuxkit/linuxkit/pulls/2068","html_url":"https://github.com/linuxkit/linuxkit/pull/2068","diff_url":"https://github.com/linuxkit/linuxkit/pull/2068.diff","patch_url":"https://github.com/linuxkit/linuxkit/pull/2068.patch"},"body":"**- What I did**\r\n\r\nFor security, the kernel needs to be verified after downloading it.\r\n\r\n**- How I did it**\r\n\r\nI changed the Dockerfile that downloads the kernel, to download the sha256sums.asc file, verify it with gpg, find the checksum for that version of the kernel in the sha256sums.asc file, verify the zipped kernel with it, then unzip the kernel and verify the unzipped tar file with gpg as well.\r\n\r\n**- How to verify it**\r\n\r\nYou can go into the linuxkit/kernel directory and run:\r\n```\r\ndocker build --build-arg KERNEL_VERSION=4.11.6 --build-arg KERNEL_SERIES=4.11.x --build-arg DEBUG= --no-cache -t linuxkit/kernel:4.11.6-hash .\r\n```\r\n\r\nHowever, you might need to update alpine in order to get `apk add gnupg` to work (I had to).  If **hkp://keys.gnupg.net** turns out to be too unstable in the long run, you can set a specific public key server like **pgp.mit.edu** instead.\r\n\r\n**- Description for the changelog**\r\n\r\nVerify kernel with GPG and sha256 checksum after downloading.\r\n\r\n**- A picture of a cute animal (not mandatory but encouraged)**\r\n\r\n![Goose](https://cdn.pixabay.com/photo/2013/09/01/17/35/goose-178143_1280.jpg)\r\n"},"comment":{"url":"https://api.github.com/repos/linuxkit/linuxkit/issues/comments/309298143","html_url":"https://github.com/linuxkit/linuxkit/pull/2068#issuecomment-309298143","issue_url":"https://api.github.com/repos/linuxkit/linuxkit/issues/2068","id":309298143,"user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars3.githubusercontent.com/u/482364?v=3","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"created_at":"2017-06-18T19:38:49Z","updated_at":"2017-06-18T19:38:49Z","body":"Based on the experience with Docker, all the keyservers are pretty unreliable and it is better to include the actual key in the script."}}
{"actor":{"display_login":"justincormack"}}