Additional ring encryption UX

[fnichol]

This change set contains 3 more ways to work with Ring keys when starting a Supervisor or a group of Supervisors. There are 2 new environment variables that the Supervisor honors which have a Container-driven workflow in mind, and a new pair of Ring key import/export commands on the hab CLI which are focused towards server/vm workflows. All additional functionality attempts to make working with Ring keys more simple. This is the sad part about any cryptography or encryption: you cannot eliminate the key distribution problem.

[sup] Honor HAB_RING for start subcommand.

This change introduces an optional way to set the Ring name when a
Supervisor starts via setting a HAB_RING environment variable. The
environment variable will always be overrident if the user uses an
explicit --ring option on start, meaning that a CLI arugment is always
first priority and environment variable is secondary.

Current explicit behavior:

hab-sup start --ring possums core/redis

New, alternative use with an environment variable:

env HAB_RING=possums hab-sup start core/redis

[sup] Honor HAB_RING_KEY containing key's content for start subcommand.

This change introduces a way to inject a Ring key to a Supervisor when
it starts via setting a new HAB_RING_KEY environment variable. Whereas
the previous HAB_RING environment variable contains the name of the
key (which is supposed to already exist on disk locally in the key
cache), the HAB_RING_KEY contains the contents of a key file itself.
This allows an operator to start a brand new Supervisor with the
following:

env HAB_RING_KEY='SYM-SEC-1
beyonce-20160504220722
RCFaO84j41GmrzWddxMdsXpGdn3iuIy7Mw3xYrjPLsE=' hab-sup start core/redis

or alternatively:

cat <<EOF > /tmp/key
SYM-SEC-1
beyonce-20160504220722

RCFaO84j41GmrzWddxMdsXpGdn3iuIy7Mw3xYrjPLsE=
EOF
env HAB_RING_KEY="$(cat /tmp/key)" hab-sup start core/redis

or, even:

env HAB_RING_KEY="$(curl https://extreme.trust/key)" hab-sup start core/redis

As before, there is a priority order in which CLI options and
environment variables are checked when setting the ring key on start:

1. The --ring option on the command line wins over any other setting
2. A set $HAB_RING_KEY environment variable is used next
3. A set $HAB_RING environment variable is used last
4. The Supervisor will start in an unencrypted mode

[hab] Add ring key import & ring key export subcommands.

This change introduces two new subcommands which are intended to work
together to support a server-based workflow, where "server" may mean a
bare metal server, virtual machine, cloud instance, etc.

The first is a hab ring key export subcommand which outputs the latest
ring key's file contents to standard out. For example:

hab ring key generate unicorns
#=> Successfully generated ring key unicorns-20160505003452
hab ring key export unicorns
#=> SYM-SEC-1
# unicorns-20160505003452
#
# 9vXIC0OQyfP2+MYakkhma9eU9oAM+xHPIkylFn4fXj4=

The flip side of this pairing is a hab ring key import subcommand
which consumes a standard input stream containing a ring key's file
contents, which it then writes to disk in the key cache with the correct
file name. Extending the example from above:

cat <<EOF | hab ring key import
SYM-SEC-1
unicorns-20160505003452

9vXIC0OQyfP2+MYakkhma9eU9oAM+xHPIkylFn4fXj4=
EOF
#=> Imported key unicorns-20160505003452

While this may not be terribly useful on a single system, pushing and
pulling ring keys across systems is now much easier with SSH pipes. For
example:

# Push a ring key to another host
hab ring key export unicorns | ssh node2 hab ring key import

# Pull a ring key from another host
ssh node2 hab ring key export unicorns | hab ring key import

# Pull a ring key from another host and start a Supervisor
env HAB_RING_KEY='$(ssh node1 hab ring key export unicorns)' hab-sup start core/redis

[thesentinels]

By analyzing the blame information on this pull request, we identified @metadave, @reset and @adamhjk to be potential reviewers

[fnichol]

[bookshelfdave]

should there be a ; after } here?

[reset]

Only if you are binding something with let. Just a boolean test doesn't need to have a ; after the }

[bookshelfdave]

fantastic 👏 , the tests look great, I'm can't wait to use this for testing the other pieces of crypto.

[reset]

@thesentinels r+

[thesentinels]

📌 Commit bdeda50 has been approved by reset

[thesentinels]

⌛ Testing commit bdeda50 with merge a8d4862...

[thesentinels]

☀️ Test successful - travis