Fix Alpine minirootfs download and verification

[bastimeyer]

• Download and verify PGP signature instead of sha256 sum
• Add public key ncopa.asc:
  0482d84022f52df1c4e7cd43293acd0907d9495a
  Natanael Copa <[email protected]>

---

I've noticed that the chroot_build.sh script was downloading both the Alpine minirootfs tarball and its sha256 sum over HTTP (no HSTS). Verifying the tarball using the checksum that has also been downloaded over a non-TLS connection at the same time doesn't achieve anything security-wise.

type2-runtime/scripts/chroot/chroot_build.sh

Lines 39 to 41 in 2df896e

	wget "http://dl-cdn.alpinelinux.org/alpine/v${ALPINE_RELEASE%.*}/releases/${ALPINE_ARCH}/alpine-minirootfs-${ALPINE_RELEASE}-${ALPINE_ARCH}.tar.gz"
	wget "http://dl-cdn.alpinelinux.org/alpine/v${ALPINE_RELEASE%.*}/releases/${ALPINE_ARCH}/alpine-minirootfs-${ALPINE_RELEASE}-${ALPINE_ARCH}.tar.gz.sha256"
	sha256sum -c alpine-minirootfs-${ALPINE_RELEASE}-${ALPINE_ARCH}.tar.gz.sha256

This PR therefore adds the PGP signing pub-key of Alpine releases (0482d84022f52df1c4e7cd43293acd0907d9495a) to the repo, downloads the PGP signature instead of the sha256 sum and verifies the tarball using that.

• https://alpinelinux.org/downloads/
• https://keyserver.ubuntu.com/pks/lookup?search=0482d84022f52df1c4e7cd43293acd0907d9495a&fingerprint=on&op=index

[probonopd]

Thanks @bastimeyer. Alternatively we might want to store a hash of the files even in this repository and check against it, like we do for some other files iirc. @TheAssassin wdyt?

[github-actions]

Build for testing:
artifacts x86_64
artifacts i686
artifacts armhf
Use at your own risk.

[github-actions]

Build for testing:
artifacts x86_64
artifacts i686
artifacts armhf
artifacts aarch64
Use at your own risk.

[TheAssassin]

@probonopd checking against a specific hash is probably overkill. We trust Alpine. Authenticating the bundles is a good idea, though.