Update security of Dockerfile

[jstuder-gh]

• Use https to retrieve archive from Rakudo server
• Retrieve PGP signature from Rakudo server (https)
• Retrieve PGP public key over hkps and using full fingerprint
• Verify archive using signature (explicitly using gpg2)

[tianon]

As written, this won't actually use hkps (it'll use hkp against the hkps pool, which will generally work), but I'd also argue that when using a full fingerprint, hkps doesn't provide additional benefit since gpg will verify the fingerprint of the key after fetching which is a stronger guarantee, and not using hkps allows us to intentionally mitm for increased reliability (see docker-library/php#666), which we do on all the official build servers for the official images.

[jstuder-gh]

Thanks for the insight! I'll update the branch to use the 'ha' pool as suggested on the official image readme.

[jstuder-gh]

@tianon, I noticed that the Travis build is failing with gpg2: not found, which surprises me as it builds just fine for me on my local machine (it should be using the same base image, right?)

Would it be best to use plain 'gpg' here? Given the base image, I believe gpg is an alias for gpg2, but if not and GPG v1.* were used would that greatly affect security in this instance? Thanks.

[zakame]

@jstuder-gh gpg on buildpack-deps should already be gpg2:

θ69° [zakame:~] % docker run --rm -it buildpack-deps:stretch /bin/sh
# which gpg2
# dpkg -s gnupg | grep Version
Version: 2.1.18-8~deb9u1
# which gpg
/usr/bin/gpg
# gpg --version
gpg (GnuPG) 2.1.18
libgcrypt 1.7.6-beta
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /root/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

So better use gpg in the Dockerfile RUNs.

[jstuder-gh]

Thanks @zakame for confirming on your end. I've updated the branch accordingly.

[hoelzro]

If all looks good to @tianon, I can merge this!

[tianon]

Looks great to me! 👌

The gpg2 discrepancy was likely just an outdated base image; doing docker build --pull ... would probably help/fix that. 👍

[hoelzro]

Ok, thanks @jstuder-gh for the contribution, and thanks to @tianon and @zakame for reviewing!