[adulau]

Add optional signature extraction to pgp_keyserver so issuer key IDs and fingerprints can be expanded from structured pgp-sign objects. Enable it with extract_signatures=true; it is disabled by default and uses the already downloaded public keys, with no additional HTTP requests or dependencies.

Each signature object preserves the original binary packet in ASCII armor, its SHA-256, observed issuer claims and hashed/unhashed provenance, signature metadata, and UID/subkey context. It references the corresponding pgp-key using extracted-from. The reader handles version 3, 4 and 6 signature metadata and checks the source certificate fingerprint against the HKP index before associating signatures. Unknown non-critical packet types 40–63 are ignored without changing the signed subject; unknown critical packets still fail extraction (RFC 9580 §4.3).

max_signatures limits signature objects across the whole lookup (default 100, maximum 1000). Packet/subpacket loops, extracted claim counts and repeated UID text are bounded. Malformed data or exhausted limits retain the normal key/metadata results with explanatory comments. Issuer claims are not cryptographically verified; unsupported signature versions retain their raw packets, and embedded sub-signatures remain in their parent packets.

Install the companion pgp-sign template from MISP/misp-objects#545 before enabling the option in MISP. A matching template is bundled for older PyMISP releases. Documentation includes configuration and an example request.

Validation:

• pytest -q tests/test_pgp_keyserver.py tests/test_pgp_keyserver_signatures.py: 206 passed.
• Flake8, Black and isort checks pass; the wheel includes the exact module, helper and bundled template.
• Tests cover existing CIRCL signatures, the RFC 9580 version 6 public-certificate vector, legacy packet framing, all non-critical packet types 40–63, UID/subkey/user-attribute context across extensions, critical packet rejection, issuer conflicts, global limits, malformed packets and disabled behavior.
• A live CIRCL lookup returned 3 signature objects and 2 issuer IDs; GnuPG independently decoded the exported packets and matched the IDs.
• 2000 malformed signature payloads were handled without unexpected exceptions.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T14:09:04.167151Z	ed02214	PR opened
🔒 Security Review	✅ Completed 2026-10-15T14:11:30.291098Z	ed02214	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed02214ae3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".