clawbot 293521eeab Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181) ...

mfer ran the gpg binary to sign, export keys and verify, so it failed
wherever gpg is missing. It now uses github.com/ProtonMail/go-crypto/openpgp.
--sign-key and MFER_SIGN_KEY name a file holding one version 4 OpenPGP
secret key; a protected key's passphrase comes from
MFER_SIGN_KEY_PASSPHRASE or a terminal prompt. gen and freshen check that
the key can sign before they read any file. Verification keeps the rules
of the --require-signature fix: one primary key in the embedded block,
counted from its packets, exactly one signature, made by that key or a
subkey, and signer equal to its fingerprint. The embedded block may hold
no DSA key and no secret key, and an armored field must be one
well-formed block.

Model: opus-5-5

2026-10-08 06:54:26 +00:00

..

FORMAT.md

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 06:54:26 +00:00