From 75cc427554ae82191388315c1e058bbb94ba1aea Mon Sep 17 00:00:00 2001
From: Spencer Brown <spencer@spencerbrown.org>
Date: Tue, 29 Dec 2015 14:06:08 -0600
Subject: [PATCH] scripts: Add and trust CoreOS gpg signing key automatically

---
 .gitignore         | 3 +++
 scripts/get-coreos | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 32a24925..cdf37a8c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,9 @@ _test
 *.[568vq]
 [568vq].out
 
+# JetBrains IDE project directory
+.idea/
+
 *.cgo1.go
 *.cgo2.c
 _cgo_defun.c
diff --git a/scripts/get-coreos b/scripts/get-coreos
index 18cb56dc..984e9155 100755
--- a/scripts/get-coreos
+++ b/scripts/get-coreos
@@ -19,6 +19,9 @@ curl $BASE_URL/coreos_production_pxe_image.cpio.gz -o $DEST/coreos_production_px
 curl $BASE_URL/coreos_production_pxe_image.cpio.gz.sig -o $DEST/coreos_production_pxe_image.cpio.gz.sig
 
 # verify signatures
-# https://coreos.com/security/image-signing-key/
+curl https://coreos.com/security/image-signing-key/CoreOS_Image_Signing_Key.asc -o $DEST/CoreOS_Image_Signing_Key.asc
+gpg --import < "$DEST/CoreOS_Image_Signing_Key.asc"
+echo "Adding trust for CoreOS signing key:"
+echo "04127D0BFABEC8871FFB2CCE50E0885593D2DCB4:6:" | gpg --import-ownertrust
 gpg --verify $DEST/coreos_production_pxe.vmlinuz.sig
 gpg --verify $DEST/coreos_production_pxe_image.cpio.gz.sig