cas: use tmpfile when writing into disk store

Instead of writing into a temporary disk store, calculating the hash,
and then rewriting into a new entry in the diskstore with the hash as
the key, write to a tempfile on disk outside the store and then use the
new Import method to move the file into the store.
cas: use subdirectory for tmp files
Merge pull request #280 from jonboulle/cas_move

cas: use tmpfile when writing into disk store
docs: update getting started guide
Merge pull request #285 from jonboulle/gsg

docs: update getting started guide
README : Update sha256 hash of package

Updated sha256 hash of etcd-v0.5.0-alpha.4-linux-amd64.aci
Merge pull request #287 from rahulgopan/master

README : Update sha256 hash of package
*: Use sha-512 digest format

Per appc/spec#8, we should be using sha-512 hashes for speed
cas: tweaks and added tests

Mostly addressed comments in https://github.com/coreos/rocket/pull/209
- errors should start with lowercase
- split out consts for hash prefixes/lengths
- added tests for ResolveKey
- added test to check for unexpected goroutines
- revert to panicking if we get unexpected input to blockTransform
cas: drop unused afterTest func
doc: clarify where to get actool
Merge pull request #292 from jonboulle/doc

doc: clarify where to get actool
stage1: componentize stage1 rootfs construction and use make

 * Move stage1/*.go to stage1/init/

 * Split stage1/mkrootfs.sh's logical components into subdirs of
   stage1/rootfs:

   - Deriving tree from CoreOS image and caching: rootfs/usr
     * Cache management in cache.sh
     * File extraction and picking in mkbase.sh
     * File inclusions split under usr/manifest.d

   - Fakesdboot: rootfs/shim/
     * Renamed to 'shim' since we've gone past just tricking nspawn

   - Root compositing and aggregation of odds and ends: rootfs/aggregate

 * Introduction of Makefiles for every component and a simple recursive
   parallel-capable make for the rootfs tip.

 * Update toplevel build script to invoke make on stage1/rootfs and find
   init sources in stage1/init, .gitignore additions as well.

 * Removed stage1/mkrootfs.sh

 Since the image cache has moved there will be an image download on first build
 in the new arrangement.  The caching has also been improved to handle CoreOS
 image revision changes by naming the cached signature with a hash of the URL.
stage1/rootfs/shim: addition of parens to silence new use of gcc -Wall
gitignore: include .DS_Store for osx users

https://www.aorensoftware.com/blog/2011/12/24/death-to-ds_store/
Merge pull request #301 from gdi2290/patch-1

gitignore: include .DS_Store for osx users
*: switch cas using first half of sha512

This changes the CAS to use only the first half of a SHA512 when
creating the keys to store images on disk. Similarly, rkt stage1 uses
only the first half of the sum when creating the directories for each
app image.

This is exposed slightly to stage0/run because it attempts to verify the
hash of the image. This should be revisited+cleaned up.
Merge pull request #290 from jonboulle/rckclmbr-sha512

*: sha256 -> sha512
add support for managing opengpg keys and ACI signature validation

This patch adds support for managing trusted opengpg keys in a keystore backed
by the local filesystem. Trusted keys are stored in following directories by
default:

* /etc/rkt/trustedkeys/root.d
* /etc/rkt/trustedkeys/prefix.d
* /usr/lib/rkt/trustedkeys/root.d
* /usr/lib/rkt/trustedkeys/prefix.d

Each trusted key is stored using the key fingerprint as the name and the key
in OpenPGP ASCII Armor format as the contents.

OS vendors can store system-wide trusted keys in the trusted keys directories
under /usr, which can be overridden by creating an empty file under /etc with a
matching name (fingerprint).

This patch also adds support for validating ACI signatures against trusted keys
found in the local keystore.

Fixes #215
Merge pull request #221 from kelseyhightower/trusted-keys

add support for managing opengpg keys and ACI signature validation