Module verify 

Signature verification.

Two layers are kept deliberately separate:

• Cryptographic layer — verify_signature checks a single detached PGP signature against the artifact bytes using the publisher’s public key. It is a pure “does this signature hold?” answer with no notion of trust.
• Policy layer — check decides whether the set of signers that produced valid signatures intersects with the user’s TrustStore. Only the policy layer can produce Error::UntrustedPlugin.

Backend

The cryptographic layer prefers the in-process RNP library (Ribose’s OpenPGP implementation, loaded via libloading). When librnp is not loadable — e.g. it isn’t installed on the host yet — the verifier falls back to shelling out to gpg --verify. The fallback exists so the trust model is enforceable in environments without a pre-built librnp; once rnp-rs (see TODO.roadmap/13-rnp-rust-binding.md) ships, the fallback will be removed and RNP becomes the sole backend.

See TODO.roadmap/06-module-registry.md for the trust model (publisher identity = PGP key registered in publishers/, artifact signature = detached PGP in sigs/).

Enums

Verification

The outcome of a signature check.

Functions

check

Apply the trust policy: the artifact is trusted iff at least one of signers is present in trust. Returns Error::UntrustedPlugin when unverified and allow_untrusted is false.

verify_signature

Verify a single detached PGP signature.