GnupgSignatureVerifier

Verifies a detached OpenPGP signature by asking the `gpg` already on the machine. Shelling out rather than binding ext-gnupg: the extension is rarely installed, while the binary is on every host where an operator has a key at all — and it is the same `gpg` that verifies the project's releases, so the operator surface and the supply chain answer "who signed this" through one implementation instead of two that can drift. The reading is done on the machine-readable status stream, never on the human-facing text. That text is localized: on this machine it says *Firma correcta*, and a verifier that greps for "Good * signature" would silently accept every signature in a Spanish locale by finding nothing to object to. `--status-fd` emits `GOODSIG` and `VALIDSIG` in every language.

public function __construct(string $gpgBinary = 'gpg'):

Parameters

public function verify(string $payload, string $signature): ?Milpa\ToolRuntime\Identity\VerifiedSigner

Hands both halves to gpg and reads its machine-readable verdict: the signer, or nobody.

Parameters

public function whyNot(string $payload, string $signature): ?Milpa\ToolRuntime\Identity\SignatureRefusal

Why this signature establishes nobody, or null when it does (greenhouse evidence/1071, B9). Asked only after {@see verify()} refused, so gpg runs a second time on the refusal path alone. It reads the same status stream and never returns a signer: the gate's answer is already «no».

Parameters