[adulau]

Add pgp-sign to store an original ASCII-armored OpenPGP signature packet, its binary-packet SHA-256, issuer key IDs/fingerprints, signature metadata, and source key/UID/subkey context. Use pgp-sign --extracted-from--> pgp-key (or another source artifact); an existing pgp-meta object may also reference the signature with extracted-from.

Only signature is required. Issuer claims can be absent or conflicting, so issuer fields allow multiple values and explicitly describe their unverified status. UID body hashes preserve exact subject identity when display text is omitted or lossy. All attributes use existing MISP types and default to to_ids=false.

Companion expansion: MISP/misp-modules#938.

Validation:

• All 449 object templates pass JSON schema and UUID uniqueness checks.
• The new definition matches jq -S -j formatting and the module's bundled copy.
• Relationship name/opposite checks pass.
• Strict PyMISP serialization is covered by the companion module tests.

Local validation used these individual checks; the validate_all.sh wrapper requires sponge and uuidparse, which are not installed in the workspace.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T14:08:17.922406Z	dbc1408	PR opened
🔒 Security Review	✅ Completed 2026-10-15T14:09:37.940282Z	dbc1408	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.