clawbot e00ec787e8 Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181) ...

mfer ran the gpg binary to sign, export keys and verify, so signing and
loading signed manifests failed wherever gpg is missing. It now uses
github.com/ProtonMail/go-crypto/openpgp. --sign-key and MFER_SIGN_KEY
name a file holding one version 4 OpenPGP secret key; a protected key's
passphrase comes from MFER_SIGN_KEY_PASSPHRASE or a terminal prompt. gen
and freshen check that the key can sign before they read any file.
Verification keeps the rules of the --require-signature fix: one primary
key in the embedded block, counted from its packets, exactly one
signature, made by that key or a subkey, and signer equal to its
fingerprint. A DSA key is refused, and so is an armored field that is
not one well-formed block.

Model: opus-5-5

2026-10-08 05:21:16 +00:00

..

FORMAT.md

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 05:21:16 +00:00