stage1: componentize stage1 rootfs construction and use make

 * Move stage1/*.go to stage1/init/

 * Split stage1/mkrootfs.sh's logical components into subdirs of
   stage1/rootfs:

   - Deriving tree from CoreOS image and caching: rootfs/usr
     * Cache management in cache.sh
     * File extraction and picking in mkbase.sh
     * File inclusions split under usr/manifest.d

   - Fakesdboot: rootfs/shim/
     * Renamed to 'shim' since we've gone past just tricking nspawn

   - Root compositing and aggregation of odds and ends: rootfs/aggregate

 * Introduction of Makefiles for every component and a simple recursive
   parallel-capable make for the rootfs tip.

 * Update toplevel build script to invoke make on stage1/rootfs and find
   init sources in stage1/init, .gitignore additions as well.

 * Removed stage1/mkrootfs.sh

 Since the image cache has moved there will be an image download on first build
 in the new arrangement.  The caching has also been improved to handle CoreOS
 image revision changes by naming the cached signature with a hash of the URL.
stage1/rootfs/shim: addition of parens to silence new use of gcc -Wall
add support for managing opengpg keys and ACI signature validation

This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:

* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d

Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.

OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).

This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.

Fixes #215
Merge pull request #221 from kelseyhightower/trusted-keys

add support for managing opengpg keys and ACI signature validation
pkg: add prototype flocking package

Add a simple package to facilitate placing an flock on directories. This
will be use to coordinate state between running containers and rkt
status/gc tools.
pkg/lock: cleanups, blocking vs. nonblocking calls, FD extraction
rkt gc: implement gc

Container directories deemed inactive by exclusive lock acquisition are
atomically renamed to /var/lib/rkt/garbage, the directory's ctime gets
updated as part of the rename.

The /var/lib/rkt/garbage directory is then scanned for directories having a
ctime older than --grace-period (defaults to 30m).  Qualifying directories
are deleted under another exclusive lock.

All lock acquisitions are non-blocking with failures being ignored.

Functions like gc status will have the grace period window for retrieving
statuses from inactive containers in either the containers or garbage
dirs, and should access the status files under the protection of a shared
lock.

Examples:

 Container "a983198b-79e3-432e-ad31-f105e96aa003" has recently exited:
   $ bin/rkt gc
   Moving container "a983198b-79e3-432e-ad31-f105e96aa003" to garbage
   $

 Immediate subsequent gc finds nothing to do:
   $ bin/rkt gc
   $

 Immediate subsequent gc force-discard by setting grace period to 0:
   $ bin/rkt gc --grace-period=0
   Garbage collecting container "a983198b-79e3-432e-ad31-f105e96aa003"
   $
pkg/lock: simplify DirLock interface

This moves to a very basic DirLock interface (which represents only an
active lock), and functions to create the respective lock types
(TryExclusiveLock, TrySharedLock, ...) instead of methods.
pkg/lock: add DirLock tests
stage0: propagate lock err directly
Merge pull request #302 from jonboulle/jon-gc

rkt: gc command
Update dir_test.go
Merge pull request #306 from gprggr/dir_test

pkg/lock: fix err check in test
Update tar.go

If os.OpenFile(...) returns err != nil, f will be nil. So f.Close() would cause a "nil pointer dereference".
Merge pull request #308 from gprggr/tar

pkg/tar: fixing possible nil pointer dereference
Merge pull request #298 from vcaputo/usemake

Refactor mkrootfs.sh into collection of subdirs and Makefiles
*: add license header to all source files

h/t @johndeng for raising this in #305
Merge pull request #307 from jonboulle/license

*: add license header to all source files
pkg/tar: Create a function for single tar file extraction so it can be reused by
different tar extraction functions.
pkg/tar: Add overwrite option to ExtractTar.