GnupgSignatureVerifier

Verifies a detached OpenPGP signature by asking the `gpg` already on the machine. Shelling out rather than binding ext-gnupg: the extension is rarely installed, while the binary is on every host where an operator has a key at all — and it is the same `gpg` that verifies the project's releases, so the operator surface and the supply chain answer "who signed this" through one implementation instead of two that can drift. The reading is done on the machine-readable status stream, never on the human-facing text. That text is localized: on this machine it says *Firma correcta*, and a verifier that greps for "Good * signature" would silently accept every signature in a Spanish locale by finding nothing to object to. `--status-fd` emits `GOODSIG` and `VALIDSIG` in every language.

public function __construct(string $gpgBinary = 'gpg'):

Parameters

public function verify(string $payload, string $signature): ?Milpa\ToolRuntime\Identity\VerifiedSigner

Hands both halves to gpg on disk and reads its machine-readable verdict. Temporary files rather than stdin because a detached signature needs two inputs, and both are removed whatever happens — the payload names an operation and its arguments, so leaving it behind would leak what an operator was about to do.

Parameters