Verify downloaded distributions cryptographically

[tartansandal]

• modifies verify command to verify the current stack
• adds --verify option to add, pull, update, and install commands
• add PINTO_GNUPGHOME for using dedicated keyring
• fix Tester.pm so test_name is propagated
• adds a --strict flag to make verify warnings fatal

Note: requires 2 new modules for the Pinto stack: Safe and Module::Signature

[thaljef]

I'm still wrapping my head around the signature mechanics, so I don't have any comment on that yet.

It seems like the audit command is intended to be an extensible interface for reporting arbitrary information about distributions in your repo, like "tell me all dists with a GPL license", "or tell me all dists that don't have any tests".

Therefore, the essence of the audit command is (or should be) a visitor pattern that can invoke arbitrary code on each distribution. So the actual business of verifying signatures seems orthogonal to the command itself. In other words, verification is an extension or plugin to Action::Audit, but not part of it.

Does that make any sense? Or have I completely misunderstood your vision?

[tartansandal]

Added 8 commits to hopefully address issues raised. Many thanks for looking over this. Travis is still complaining which is sad :-(

[tartansandal]

After writing #186, I'm thinking that, rather than having 2 options, --verify-upstream and --verify-upstream-strictly, we should set an --upstream-verification-level with 5 meaningful levels.

[tartansandal]

After cloning pinto-release into my test repository, the behaviour of the verification command is very slow. This was the motivation for adding the progress meter dots. Not sure why this is happening, but the slow down is substantial and warrants investigation. Maybe slow upstream or, well, a bug.

[tartansandal]

This PR has gotten way to messy. I'm going to close it and rebase a fresh one.