Add some more process around releases

  -Add code signing to the artifacts
  -Add some new release instructions

README.md

@@ -30,6 +30,31 @@ $ go get github.com/tools/godep
 $ godep go build ./...
 ```
 
+### Building for release
+#### To do a build:
+1. Cut a branch
+2. Tag it with the relevant version, and push the tags along with the branch
+3. If the build doesn't trigger automatically, go here: https://circleci.com/gh/mesosphere/mesos-dns, find your branch, and trigger the build.
+
+#### If you choose to do a private build:
+1. Fork the repo on Github to a private repo
+2. Customize that repo
+3. Add it to Circle-CI
+
+    Circle-CI allows for private repositories to be kept, and built in private
+4. Go to the build steps.
+
+#### Releasing
+1. Download the artifacts from the Circle-CI builds
+2. Cut a release based on the tag on Github
+3. Upload the artifacts back to Github. Ensure you upload all the artifacts, including the .asc files.
+
+#### Code signing
+This repo using code signing. There is an armored, encrypted gpg key in the repo at build/private.key. This file includes the Mesos-DNS gpg signing key. The passphrase for the key is stored in Circle-CI's environment. This makes it fairly difficult to leak both components without detectable maliciousness.
+
+There are only very few users with access to the private key, and they also have access to a revocation certificate in case the private key leaks.
+
+
 ## Testing
 ```shell
 $ godep go test -race ./...

build/private.key

@@ -0,0 +1,57 @@
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+Version: GnuPG v2
+
+lQc+BFZUG5MBEACrL7TPdHDZJlWs09+AicV8EghnWynJ3Py1EkxVxukaFa+QAmMt
+8F7pB19F7B0xJRswLgTyqP00ynX+WRhOKu4FHikiwByUZ7Mt9qU0zTxe2zClxfSl
+caVXBrDGLvetA+9vUZKXTjNFxfsaPbZS8CmGEpQCKWvDxx9d3NgwDYm6+Ila3nHC
+7Rr9Ge2SFcLsSEVtzYzHwJf3m7siXHDjNbx1ZiSb6wG9t8JPWEMTG2JjU86Ewof3
+5FZ46fR+Fxii7/iFNMVXnGyRrQcCEKFtIWzTGeY12bcpgaJfQi3XvQE26icz6P+9
+hDl1gf9yCSJL/cAUkL/W/ZDodVMAthaPdVpzisspPnt8Hw1oW1numrzGpxCgQAtK
+Rb4Ay+xZLDy1ai52zJ4UDaMF4AcxmP/xN5mGtd7f8OqNiB+YqaNSsVCg6DqRapXp
+z2wnIloElPjN0pLWOhZ3/ekpsQWxq1VrnFUxVMurXwi1xYkvTxUT1DawXjMOgQ+p
+eFUonlfqgUvuwh/QIamkHinkxPOFXe9XhXFoYOueU1w2sLJt4qc0jVtMMCuz7mec
+1790HOdfIuBpBiYSDkohrkMPpGLvd95x9CeufKL1zJEPgoS2w6aVEWO7HDy4we9k
+AWWd3P+SHCZBJMaYSQicIviuuEbRTZAvuFhpbTGaX7pTmbJuwxCBOS7l4QARAQAB
+/gMDAvLDn21MCDgo5qKTW/OjXSiBvh4ZX5hQ5WJosJQGoZHmrQPhcUk8TeT9xEGr
+22f1Yg0sls2DS2qir20CtK4Tmtwsf3LUZjbXHQFq61LlJAgIYiK9xZIW3s8GYJru
+fETuPcNTDnabl1wuPq0WlvmbQPAVajHIV78b1x6Ru2Xt2WtNTUkCFZXcVTgkPkak
+hcfMMeZOUD050RXlbgXxR6oQZBVenzwfkjuYBpFP15OKu/6f5JaTO2idkRuFfg9r
+XOyNw1p7YH77fH2M3x4qVU6SMuMXmDYkC74/gXct9zzDIMKEipFMsmMknbl1L4Uz
++psXZEgQKtS5CJZUtsmK3j2sm900H0rgyv6is5fWaMpfe3F9GE/RnNB1SxsRN2xs
+d5N9tzkPv+6Lvsd459q/R+MDSPMTftMeZ2hFAEcxWSi8a6a4A1iyH+vLcjFr8iz9
+Tm/ZB4vKT59xDR5OYqZ2IK2EG1Xl5s6I0oRoAASdhzdJEnZwKfSmcGzJ/ARmusy2
+jlUYMqgnVGOr9KrWu9jVpR6wUfFXlmwzPLs44nfFZxBu9MC63m0hItknxfhA1URv
+d1+T97GkjxGN0GO3txxNuadKk2dWPhuj/2SLjsc6ewcmyGjQFdEGWmqHPSV/lhS8
+EBV2K97QB+VjKAC69CG0+DtpGd7eR7pGY9HmQQFHh4QF+pshw90ZsHpK/DngXxO1
+fADNQdQdmREucRrMwrZuTRLo3zQFGtvN6a5hWhJBHK/twg3/6BkaA/My+n4rTpV4
+dhFof3ln8VK6wXrk3oAabRvWwXKSLMgZjV2MvAFJKZtHJEVlHhhBT0flqnRB78EW
+0PNe5/SsbWTxpH2t14CROIX+fRl7ChPf4PNoSd3aU+C+BCRHeT1csj5xtULhdpjX
+H/GbmhBz2cX6KtHlBRKg4OvuaWy4+KqOoZ8Lrg9nXAWy8AgHp4IabnZxHd0B1bLr
+TCNZfTMjjnvsoppr2t9/bdZDEjwxeA6RB7YcjrB0YGkR1o1u+3C1n5Jzb2nPW6ZS
+h6V5OqYca41NddlK0wCBPam2ERFyMCDPYKgJzSeadyRf8N7L5FmqHSHc+m4Nwcg1
+bSkzIA0gPsKmcbkvC8ql1HbbWAgmGqSmrne1nEGXG3mMNkQPn2TsJ5KYYueCG5kI
+tMKiI9S6R2gl6mdT93h0FjE3vS3UofZgCMbFlss/uKDwLtCau09Z/CHKXwp/5y7G
+u2nl4NmHqsxtWRlcq7/Ex+HkvFpjZ15SS1dh9IdnZveAq0mJQX8D+2FQUHb7dD8B
+g6wVQ8gg2wK61yI5zp/+HWaKdwnxwGh0co5+uGU3Xl2IyBxvmK15dvcxRob2KrhW
+O+fFJS1s7CA5knqq1uKthWL3nkxYq1aBSC/z4LMVrtcDTTk1nD0V6P6juPzHZ1V5
+NbT5t6cMYXWIuAoA+Qo9uk7aQNBPvaHYs3Q+nSx9aDDcQuvU8g30pd39YdjkTzEc
+1RMzPz/p3FwNWYt8dYprY/a0ZP/dkhM6xi2fb1nnQnMQ+tM+lcOth0mVwk6l1rzl
+wk4exuCu7JH+s6gZhW5TBZ/HreKSRE4huacaQFlp3bs6i4YYU02ypAxshmP018O2
+LHtPHju5b5ClKtYIyfLd3X81nUAt7JE46Hg6ziEJZzbnOI5KZbaAOkg2qKgESiKx
+/XtuiI3TGTfcRiT7THljOHGJd3vn7I1v6KNbKeQXxmswNNkbeX+ToleEFjm4V1UY
+8tl3dPnm0+YL1mhMtZbzvd3LoxBmfA+pc/A+/N7cnDyztEFNZXNvcyBETlMgKE1l
+c29zIEROUyBidWlsZCBzaWduaW5nIGtleSkgPG1lc29zLWRuc0BtZXNvc3BoZXJl
+LmlvPokCOQQTAQIAIwUCVlQbkwIbAwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheA
+AAoJEBEaA3G9KS9HNeUP/28YOmcseE1f6CU2LYU2F8FBgBpRhC/XJFUDbTG4YzRp
+CUSvvKQZYDgW8hLGD/U4iZ8UEJzjERn8jhwqzXmxnnU+UW+ccvwoDO1V5+40PBA3
+6jH+ZlsFzzVOI4p3IbP0yOpb3tp73XWyZhj68wdMKe9qbjm2poSWk6jv82d8a7qj
+rKDlHUi9fOC5ZQhlo0IohAyYGvAk0j9Ba1UqatMGSzFLBJoWkodSEm+SFannDdeZ
+SHGdD4ndxRdNy1rKtU/pdYf+kOVEdO5+FQFBD6tFRnLUNVUozG7cNGqSUudnT/y8
+wQK5zf2lyfRG5FErIHIXP4GzCDr3ZUjkTMmu4rrCaiHs6xn7Of08mCEf+WiLwQZY
+JBH26O4lzglk/hCC8AbuBWCjcA8IGypy5v/gOriqMwhRic2yMQ1tLwzR1V+Dtjmf
+nJ53hVNPqek1aOQs5YH5IKYmpAJ6QpwzYq8kDI90hca6pMJMVZGhv9Tqa4Z6pNK/
+so7gWF+T5vpfW1acZtXugh64u5CXoae58vNoe0FRQCwOYAXbws/fl+wtSLdFhQEW
+/CVDybRU/tq7QpXAtne1dR20lOvkE1TdP0M6ZEwOc+qgG6pUbjaeCsOCFTAIS+ry
+4F+TZVFReyTK+lWvYu4ucXiQr+0ffiRodE8UL8jZ47gi1XNJCOvBgULKlco0xBRX
+=zHp/
+-----END PGP PRIVATE KEY BLOCK-----

build/public.key

@@ -0,0 +1,41 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2
+
+mQINBFZUG5MBEACrL7TPdHDZJlWs09+AicV8EghnWynJ3Py1EkxVxukaFa+QAmMt
+8F7pB19F7B0xJRswLgTyqP00ynX+WRhOKu4FHikiwByUZ7Mt9qU0zTxe2zClxfSl
+caVXBrDGLvetA+9vUZKXTjNFxfsaPbZS8CmGEpQCKWvDxx9d3NgwDYm6+Ila3nHC
+7Rr9Ge2SFcLsSEVtzYzHwJf3m7siXHDjNbx1ZiSb6wG9t8JPWEMTG2JjU86Ewof3
+5FZ46fR+Fxii7/iFNMVXnGyRrQcCEKFtIWzTGeY12bcpgaJfQi3XvQE26icz6P+9
+hDl1gf9yCSJL/cAUkL/W/ZDodVMAthaPdVpzisspPnt8Hw1oW1numrzGpxCgQAtK
+Rb4Ay+xZLDy1ai52zJ4UDaMF4AcxmP/xN5mGtd7f8OqNiB+YqaNSsVCg6DqRapXp
+z2wnIloElPjN0pLWOhZ3/ekpsQWxq1VrnFUxVMurXwi1xYkvTxUT1DawXjMOgQ+p
+eFUonlfqgUvuwh/QIamkHinkxPOFXe9XhXFoYOueU1w2sLJt4qc0jVtMMCuz7mec
+1790HOdfIuBpBiYSDkohrkMPpGLvd95x9CeufKL1zJEPgoS2w6aVEWO7HDy4we9k
+AWWd3P+SHCZBJMaYSQicIviuuEbRTZAvuFhpbTGaX7pTmbJuwxCBOS7l4QARAQAB
+tEFNZXNvcyBETlMgKE1lc29zIEROUyBidWlsZCBzaWduaW5nIGtleSkgPG1lc29z
+LWRuc0BtZXNvc3BoZXJlLmlvPokCNwQTAQIAIQIbAwIeAQIXgAUCVlQ7LAULCQgH
+AwUVCgkICwUWAgMBAAAKCRARGgNxvSkvR0PJEACpxajcq1iOjZV54fyVSDTNGP/4
+T2WoxymiyToUzu4VunC5uLvjbBPFJNdKubIZ1vol1EyENW0cDzeaLAQkOtXeNTjg
+glolHJE66OPuPwDqGyjW5Ct6HDjJkAJSyu4gqeNUqWfDj3wHGedTaTykwK0/hEb4
+en+jK0gsi7abosxzP693DNlxj8xabUHW7KpUsNoSXidehALk/rpCztw62vJaUgln
+e0ovjZ5+IIvjaP2NAy7FmKVN7FeVddMrnIfQFP0qwONWFfsmSaVtBnTGgj4vDL/K
+sxoMf2x7Z3wKZD9duc+34SSz7a80qjegjN1VyzFcmZzAEX/Q6DwTL01T8VnNWaw+
+sFeNOKcBfZg+HWqbk0s5YqZjhq0+3a4xgGTlXjr47DCwZLa8b6zush7bsrNOBh+L
+GFm6zDcSGYSE2ebNfs+q/6zWsL0I43Zjpwqk7/TFB9feWk3szkqCDeD3tEpH3O8S
+uZr7bKsf9b5rZygW8qDSTm5o7H7iNQl93NWGocIHXOpJ7bJXIFMcYW1qsTo3GG/v
+vZfcu+OIh69zugExb966asyF3k4NSvXlfPYbcxsxVQr4PkIxmGAUKmB+csb1FbkL
+01npg0T9X5sWqdyjJdQEbDFAaTHWaLkU1i5WoTStUbufwJYtKJvuvOdKnV1HMJVX
+IzI5wVgY2F3SR01tzokCHAQQAQIABgUCVlQbsQAKCRCTzIgvionf5uQHD/90nX7z
+GzTJ2Imw+gcmAi121qnFd7PQWj2f5NvH486EBru+m46NQ8WZyd3LM4qPa/0T4VBH
+lz3V8CSpasVD9B8s+wMQqwECO81sBAaAyaE89036ViC/Hv3YoFHP4hSHGr2PagGH
+b+1XCKdjVB9WIYz96cHKgWETQXYIyMmPhSuCi9ZggzZwKBDaVHhq3DkMmCw0+0tX
+6kuCZ1seRoJMMVYic6WsjQV7N2UbznckAFX1ZKVttzLSDlbO7A1GqTqPZa68Fmp4
+9xkuFkvFM+Hl68ZN4PQJwjxLLqJAM6yl6n5egOc9Vp8ya8LLU8mrV9q9H8MqEnrv
+YHCej+xnspvUeM+PlPccc7EB8f44q/T7QtMS1C1qTgRO68/6mLlFVtrYv5WxGUNW
+gDfT435TNMRvCel2dNB6r3iNRtqG3kM7aMljYrI9iPdF5BIj88O7P0iOfBkp7v2P
+luVDp2irINQlzY8+ZWdpx08AysO855nkZ4jiKgzxTspYRabAOukVc3w0p3d9M8uh
+jkEESbHNFha6/DBBnXYy3/U8qEDgHW+hfkTR++9jPAGE3lb6NTeD4pjfM7bfzwcj
+8RJqJFvR0LaO5kyAgu+i50/C+Xh4lj4ggwITK708NUgp4Y7CdcT/I9nEcgz/heep
+yGRNN46mhOQz2DYTrzDqDK4XgKud9egMn4lf0Q==
+=CANC
+-----END PGP PUBLIC KEY BLOCK-----

circle.yml

@@ -17,12 +17,13 @@ dependencies:
     - go get github.com/axw/gocov/gocov # https://github.com/golang/go/issues/6909
     - go get github.com/mattn/goveralls
     - git describe --tags > VERSION
+    - gpg --yes --batch --import build/private.key
   post:
     - go install ./...
     - go test -i ./...
     - gometalinter --install
     - gox -arch=amd64 -os="linux darwin windows" -output="${CIRCLE_ARTIFACTS}/{{.Dir}}-$(<VERSION)-{{.OS}}-{{.Arch}}" -ldflags="-X main.Version=$(<VERSION)"
-
+    - for i in ${CIRCLE_ARTIFACTS}/*; do gpg --detach-sig --no-use-agent --yes --batch --passphrase=$PASSPHRASE -u mesos-dns --sign --armor $i; done 
 
 test:
   override: