fedup.download: minor import cleanup
fetch/verify .treeinfo.signed if gpgcheck is on (#877623)

If instrepo.gpgcheck is True, we will try to fetch .treeinfo.signed and
verify its GPG signature; if that fails, raise an exception and bail
out.

Since we also use .treeinfo to check the integrity of the boot images,
if the .treeinfo signature is good then we can assume that the boot
images are also authentic.
Add --nogpgcheck

If you really need to disable GPG signature checking for some reason,
the --nogpgcheck flag will cause fedup to completely skip all signature
verification for packages and boot images.
add util.rlistdir()

Returns a generator that recursively descends the given directory and
yields all of the files found. Basically listdir(), but recursive.
Add comment about API stability to __init__.py

Seriously, this isn't a library for public consumption, please don't use
it as such. If you think you need to do this for some reason, email me
and we'll figure something out.
fixes for check_signed_file() etc.

This patch fixes a couple of problems with check_signed_file and friends
* missing 'self' argument
* handle 'file:///' path arguments
* add better comment for _checkSignatures
* minor refactoring
* remove our _getKeyImportMessage (the existing one works fine)
Add/import keys for instrepo so we can check .treeinfo.signed

In order to check .treeinfo.signed we need to find its key. In the
absence of a user-supplied key (which will be added in a future patch),
we need a default key - just like the default repo.

Once we have a key file, we import it into fedup's personal keyring.
We can then use that in check_signed_file to verify .treeinfo.signed, as
expected.
logutils: handle yum logginglevels correctly

This lets us get crazy amounts of logging out of yum, if needed.
improved log messages during depsolving

Set up a verbose_logger so we can get log messages out of yum,
improve/clarify log messages from pkgAdded, and fix a backward log
message in the depsolve callback. (fixes #19)
fix instrepo key import

We need to import instrepo's key(s) *after* we create gpgdir, obviously.
Move it into check_signed_file() so it happens at the right time.
refactor: drop _import_key()

This only got called from one place, and we can do a better job than
this. Move the code into the place it was called from.
refactor: add init_keyring, list_keyring, import_key

More code refactoring. No behavior changes except perhaps slightly
different log messages.
refactor: add _setup_keyring()

Moving this into its own function makes logical sense - it's possible we
might want to use it elsewhere, but it's also much easier to understand
what's actually going on here.
fix rm_rf() for non-directories

C'mon, let's use the BIG hammer!!
use a clean gpg keyring every time

This makes sure we don't end up with stale/no-longer-trustworthy keys
stuck in a cached GPG keyring.
download.py: improve logging from check_keyfile etc.

Makes the logs clearer and easier to read.
check_keyfile: fix false positive for RPM trust

It turns out that keyInstalled returns -1 if the keyid isn't found in
the RPM database... which evaluates to True. Yikes.

This patch makes check_keyfile properly reject keys that came from
packages signed with an *untrusted* key.
Clarify log messages for cleanly-handled exceptions

Just 'cuz there's a traceback in the log doesn't mean we crashed.
Make it clear whether or not this is a crash or a simple failure.
Add SystemUpgrade.asciidoc

This is a draft of a distro-neutral spec for doing System Upgrades with
systemd. fedup and fedup-dracut implement this behavior but eventually
the parts described here should be upstream.

'til then, the docs should go somewhere, right?
Merge branch 'wgwoods-fedup-master' into dashea-fedup-master