Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

mfer ran the gpg binary to sign, export keys and verify, so signing and
loading signed manifests failed wherever gpg is missing. It now uses
github.com/ProtonMail/go-crypto/openpgp. --sign-key and MFER_SIGN_KEY
name a file holding one OpenPGP secret key; a protected key's passphrase
comes from MFER_SIGN_KEY_PASSPHRASE or a prompt on the terminal.
Verification keeps the rules of the --require-signature fix: one primary
key in the embedded block, counted from its packets so that keys the
library skips count too, exactly one signature, made by that key or one
of its subkeys, and signer equal to its fingerprint. Tests make their
keys in process.

Model: opus-5-5

internal/cli/gen.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -89,7 +90,9 @@ func (mfa *CLIApp) collectInputPaths(args cli.Args) ([]string, error) {
 }
 
 // buildScannerOptions constructs scanner options from the CLI flags.
-func (mfa *CLIApp) buildScannerOptions(cmd *cli.Command) *mfer.ScannerOptions {
+func (mfa *CLIApp) buildScannerOptions(
+	cmd *cli.Command,
+) (*mfer.ScannerOptions, error) {
 	output := cmd.String("output")
 	opts := &mfer.ScannerOptions{
 		IncludeDotfiles:    cmd.Bool("include-dotfiles"),
@@ -111,13 +114,15 @@ func (mfa *CLIApp) buildScannerOptions(cmd *cli.Command) *mfer.ScannerOptions {
 
 	// Set up signing options if sign-key is provided
 	if signKey := cmd.String("sign-key"); signKey != "" {
-		opts.SigningOptions = &mfer.SigningOptions{
-			KeyID: mfer.GPGKeyID(signKey),
+		signing, err := mfa.signingOptions(signKey)
+		if err != nil {
+			return nil, err
 		}
-		log.Infof("signing manifest with GPG key: %s", signKey)
+
+		opts.SigningOptions = signing
 	}
 
-	return opts
+	return opts, nil
 }
 
 // enumerateInputs runs the enumeration phase over the argument paths,
@@ -202,20 +207,52 @@ func (mfa *CLIApp) runEnumeratePhase(cmd *cli.Command, s *mfer.Scanner) error {
 	return nil
 }
 
+// runScanPhase reads the enumerated files and writes the manifest to out,
+// with optional progress reporting.
+func (mfa *CLIApp) runScanPhase(
+	ctx context.Context, cmd *cli.Command, s *mfer.Scanner, out io.Writer,
+) error {
+	var (
+		scanProgress chan mfer.ScanStatus
+		scanWg       sync.WaitGroup
+	)
+
+	if cmd.Bool("progress") {
+		scanProgress = make(chan mfer.ScanStatus, 1)
+
+		scanWg.Add(1)
+
+		go reportScanProgress(scanProgress, &scanWg)
+	}
+
+	err := s.ToManifest(ctx, out, scanProgress)
+
+	scanWg.Wait()
+
+	if err != nil {
+		return fmt.Errorf("generate manifest: %w", err)
+	}
+
+	return nil
+}
+
 func (mfa *CLIApp) generateManifestOperation(
 	ctx context.Context, cmd *cli.Command,
 ) error {
 	log.Debug("generateManifestOperation()")
 
-	s := mfer.NewScannerWithOptions(mfa.buildScannerOptions(cmd))
-
-	// Phase 1: Enumeration - collect paths and stat files
-	err := mfa.runEnumeratePhase(cmd, s)
+	opts, err := mfa.buildScannerOptions(cmd)
 	if err != nil {
 		return err
 	}
 
-	showProgress := cmd.Bool("progress")
+	s := mfer.NewScannerWithOptions(opts)
+
+	// Phase 1: Enumeration - collect paths and stat files
+	err = mfa.runEnumeratePhase(cmd, s)
+	if err != nil {
+		return err
+	}
 
 	// Check if output file exists
 	outputPath := cmd.String("output")
@@ -249,25 +286,9 @@ func (mfa *CLIApp) generateManifestOperation(
 	}()
 
 	// Phase 2: Scan - read file contents and generate manifest
-	var (
-		scanProgress chan mfer.ScanStatus
-		scanWg       sync.WaitGroup
-	)
-
-	if showProgress {
-		scanProgress = make(chan mfer.ScanStatus, 1)
-
-		scanWg.Add(1)
-
-		go reportScanProgress(scanProgress, &scanWg)
-	}
-
-	err = s.ToManifest(ctx, outFile, scanProgress)
-
-	scanWg.Wait()
-
+	err = mfa.runScanPhase(ctx, cmd, s, outFile)
 	if err != nil {
-		return fmt.Errorf("generate manifest: %w", err)
+		return err
 	}
 
 	// Close file before rename to ensure all data is flushed