Force authentication for cdebootstrap-static

[jturner314]

Before, during initial bootstrapping, cdebootstrap-static ignored "the unavailability of Release.gpg, missing keyrings, broken signatures, and missing gpgv executable". This commit adds the necessary dependencies to be able to perform the verifications. Following this commit, the signatures/checksums on the Release file and all packages are properly checked.

Note that before this change, downloads of all of the packages during installation were performed over an unencrypted http connection with no verification, so they were subject to man-in-the-middle attacks.

[diederikdehaas]

Thank you so much for this PR 👍

I've started playing locally to fix this pet-peeve of mine and this will surely speed things up :-)
I'll review this (and your other) PR(s) ASAP.

[diederikdehaas]

It seems to work (testing it atm), provided that the date is set correctly with rdate ... which is rather a weak point in the rcS script. Even though it's marked as non-fatal, it does become fatal when this commit is added.
I have committed this locally, but will search for (and apply) a more robust way for setting the date correctly before pushing it to the repo.

Any suggestions on this would be welcome, since busybox's sh doesn't support arrays :-/
EDIT: apparently it does support arrays :-)

[diederikdehaas]

Also adding another commit to your PR doesn't automatically close the issue, hence closing it manually.

Thanks again for your contribution 👍