I'm implementing a private provider registry in Go, according to the specification
the find a provider package response should contain the gpg_public_key
.
The go opengpg is no longer maintained and not recommended, and few alternatives are suggested. Especially for provider registry implementation, where we need to sign the shasum document, this https://pkg.go.dev/crypto/ed25519 seem to be the best bet.
However, my question is that if the ed25519 generate signature compatible with terraform cli? or Terraform CLI only work with gpg generated signature.