Adding functionality to check if GPG keys are valid for signing providers

[diofeher]

This code is used by registry repo to validate if a key was used to sign a provider.

It's going to be used on registry. It closes opentofu/registry#1423

[ghost]

Thank you for the work @diofeher. There are a few things that would need to be changed here. Mainly, this shouldn't be part of the metadata API. Also, this PR seems to be lacking tests.

[diofeher]

Thanks for your feedback @abstractionfactory ! This PR was meant to be a draft, didn't see it was a normal PR, sorry :( I'm still testing with the another repo....
But it's good that I received feedback already, gonna fix these issues.

[cam72cam]

I think @abstractionfactory has been looking forward to getting this fixed for a while :)

[ghost]

Have I ever! :D Thanks for all your hard work @diofeher !

[ghost]

Hi @diofeher thank you very much for your work!

[yhakbar]

Most of my comments are NITs.

Given that I'm not a maintainer of the project, I won't give explicit approval. I don't see any major issues, though.

[Resonance1584]

Looks really good overall! I have one comment around if the gopenpgp package is thread safe

[ghost]

This is looking a lot better as far as tests and code intent is concerned, but it looks like the public signature has now switched to being an abstraction for the provider key itself, which was not the intention. If that was the case, this package would be in the wrong place (check where the provider types are).

Also, it is worth mentioning that mixing value types and tools/services in one data structure makes keeping the code clean tricky, because tools have dependencies (such as the metadata API) and it becomes had to not bloat the instantiation of the value-type with dependencies. It's a better idea to separate value types and services into separate entities.

[Yantrio]

I've moved this to draft so that we can discuss this more amongst the opentofu team.

[diofeher]

Closing this one in favor of opentofu/registry#1423