Add detached PGP signature verification for .sig files

[Copilot]

Enables SignCheck to validate detached PGP signatures generated by SignTool (added in #16035). A detached signature file must follow the naming convention: foo.tar.gz.sig verifies foo.tar.gz.

Changes

New SigVerifier

• Validates .sig files by locating the corresponding signed file (removes .sig extension)
• Returns clear errors when signed file is missing
• Linux/.NET Core only (returns UnsupportedFileTypeResult on .NET Framework)

Extracted PgpVerificationHelper

• Centralizes GPG verification logic previously duplicated in LinuxPackageVerifier
• Escapes shell arguments to prevent command injection
• Handles timestamp extraction from signature metadata

Refactored LinuxPackageVerifier

• Delegates to PgpVerificationHelper for signature verification
• Maintains compatibility with RpmVerifier and DebVerifier

Registration

• Added .sig verifier to SignatureVerificationManager for non-NETFRAMEWORK builds

Security

• All file paths and key IDs are escaped before shell execution using single-quote wrapping
• Directory operations include proper error handling for IO/permission failures
• Cleanup failures are logged but don't fail verification

To double check:

• The right tests are in and the right validation has happened. Guidance: https://github.com/dotnet/arcade/blob/main/Documentation/Validation.md
  • No existing test infrastructure for SignCheck
  • Build verified on net472 and net11.0 targets
  • Code review passed

Original prompt

---

This section details on the original issue you should resolve

<issue_title>SignCheck should validate detached signatures</issue_title>
<issue_description>Support for signing tars and zips with detached signatures was added into SignTool: #16035. We should add verification for these detached signatures in SignCheck. SignCheck would need a way to accept additional signature info for these signed artifacts (signature file, public key)</issue_description>

<agent_instructions>Allow SignCheck to validate detached PGP signatures by introducing first-class support for .sig assets.

• Add a new file verifier type for .sig files.
• Refactor the existing Linux package verification into a generic PGP verifier base (since detached signatures should be PGP-verified), and have the new .sig verifier inherit from / reuse that PGP verification implementation.
• A detached signature must always have the same name as the signed file, with an added .sig extension (e.g., foo.tar.gz ↔ foo.tar.gz.sig).</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes SignCheck should validate detached signatures #16249

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[ellahathaway]

@copilot - Instead of creating a helper class, please rename LinuxPackageVerifier to PgpVerifier, and update all references accordingly. Then have SigVerifier inherit from PgpVerifier.