Fluxion::Executor::SignatureVerifier
Verifies a detached OpenPGP signature against an explicitly trusted signer.
A zero exit from gpg is deliberately not sufficient. gpg reports success for a signature made by any key it happens to have, so the machine-readable status output is parsed and every VALIDSIG must name the configured signer.
Constants
ALLOWED_HASH_ALGORITHMS = Set {8, 9, 10}
SHA-256, SHA-384, SHA-512. SHA-1 is deliberately absent.
ALLOWED_PUBLIC_KEY_ALGORITHMS = Set {1, 3, 19, 22, 27, 28}
RSA-encrypt-or-sign, RSA-sign, ECDSA, legacy EdDSA, Ed25519, Ed448.
REJECTED = ["BADSIG", "ERRSIG", "EXPSIG", "EXPKEYSIG", "REVKEYSIG", "KEYEXPIRED", "SIGEXPIRED", "NODATA", "NO_PUBKEY"] of ::String
Statuses that mean the signature is bad, expired, revoked, or unknown.
VERIFY_TIMEOUT = 1.minute