OpenPGP Signature & Integrity Gate

id: openpgp-payload-signature-integrity-gate
namespace: company.team
description: |
  Audit OpenPGP encrypted payloads for cryptographic digital signature validity,
  enforce Modification Detection Code (MDC) tamper protection, and gate downstream
  data ingestion pipelines with automated Slack security alerts.

triggers:
  - id: scheduled_verification_cycle
    type: io.kestra.plugin.core.trigger.Schedule
    description: Periodic audit cycle evaluating staged encrypted partner artifacts
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      expected_signer_identity: "partner-secops@vendor.example.com"
      quarantine_on_tamper: "true"
      dry_run: "true"

inputs:
  - id: expected_signer_identity
    type: STRING
    displayName: Expected Signer Identity
    description: Expected signer User ID or email address matching the OpenPGP
      public key ring
    defaults: "partner-secops@vendor.example.com"

  - id: quarantine_on_tamper
    type: SELECT
    displayName: Quarantine on Tamper or MDC Failure
    description: Log incident telemetry and route modified or forged payloads
      directly to quarantine alerting
    values: [ "true", "false" ]
    defaults: "true"

  - id: dry_run
    type: SELECT
    displayName: Safe Dry-Run Evaluation Mode
    description: Audit signature verification and decryption without writing
      decrypted cleartext to downstream systems
    values: [ "true", "false" ]
    defaults: "true"

tasks:
  - id: stage_audit_payload
    type: io.kestra.plugin.scripts.shell.Commands
    description: Stage a verifiable audit batch payload in Kestra internal storage
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    commands:
      - echo
        '{"batch_id":"BATCH-2026-AUDIT-001","partner":"vendor-acme","records_count":450,"timestamp":"2026-10-10T21:00:00Z","compliance_scope":"PCI-DSS_SOC2"}'
        > audit_manifest.json
    outputFiles:
      - audit_manifest.json

  - id: encrypt_and_sign_payload
    type: io.kestra.plugin.crypto.openpgp.Encrypt
    description: Encrypt staged payload with recipient public key and attach digital
      signature using sender secret key
    from: "{{ outputs.stage_audit_payload.outputFiles['audit_manifest.json'] }}"
    key: "{{ secret('PGP_RECIPIENT_PUBLIC_KEY') }}"
    recipients:
      - "data-engineering@internal.example.com"
    signPublicKey: "{{ secret('PGP_SENDER_PUBLIC_KEY') }}"
    signPrivateKey: "{{ secret('PGP_SENDER_PRIVATE_KEY') }}"
    signPassphrase: "{{ secret('PGP_SENDER_PRIVATE_KEY_PASSPHRASE') }}"
    signUser: "partner-secops@vendor.example.com"

  - id: decrypt_and_verify_signature
    type: io.kestra.plugin.crypto.openpgp.Decrypt
    description: Decrypt payload using recipient private key, verify one-pass
      signature, and validate signer identity
    allowFailure: true
    from: "{{ outputs.encrypt_and_sign_payload.uri }}"
    privateKey: "{{ secret('PGP_RECIPIENT_PRIVATE_KEY') }}"
    privateKeyPassphrase: "{{ secret('PGP_RECIPIENT_PRIVATE_KEY_PASSPHRASE') }}"
    signUsersKey:
      - "{{ secret('PGP_SENDER_PUBLIC_KEY') }}"
    requiredSignerUsers:
      - "{{ inputs.expected_signer_identity }}"

  - id: evaluate_signature_status
    type: io.kestra.plugin.core.flow.Switch
    description: Evaluate verification result and route to compliance clearance or
      quarantine alert
    value: "{{ outputs.decrypt_and_verify_signature.uri is defined ? 'VALID' :
      'QUARANTINE' }}"
    cases:
      "VALID":
        - id: log_compliance_verified
          type: io.kestra.plugin.core.log.Log
          description: Log verified cryptographic authenticity and MDC integrity protection
          message: "OpenPGP digital signature and MDC integrity check PASSED. Verified
            signer identity: {{ inputs.expected_signer_identity }}. Decrypted
            cleartext storage URI: {{ outputs.decrypt_and_verify_signature.uri
            }}."
        - id: check_dry_run_dispatch
          type: io.kestra.plugin.core.flow.If
          description: Check dry run toggle before promoting decrypted cleartext to
            downstream pipelines
          condition: "{{ inputs.dry_run == 'false' }}"
          then:
            - id: log_payload_promoted
              type: io.kestra.plugin.core.log.Log
              description: Record successful cleartext promotion to ingestion pipeline
              message: "Payload signature verified. Cleartext URI {{
                outputs.decrypt_and_verify_signature.uri }} promoted to
                downstream pipeline."
          else:
            - id: log_dry_run_verified
              type: io.kestra.plugin.core.log.Log
              description: Record dry-run audit verification without cleartext promotion
              message: "DRY RUN: OpenPGP signature verified for {{
                inputs.expected_signer_identity }}. Cleartext promotion skipped
                (dry_run=true)."
      "QUARANTINE":
        - id: evaluate_quarantine_alert
          type: io.kestra.plugin.core.flow.If
          description: Evaluate quarantine alerting toggle before dispatching Slack
            notification
          condition: "{{ inputs.quarantine_on_tamper == 'true' }}"
          then:
            - id: alert_signature_tamper
              type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
              description: Dispatch high-priority alert to SecOps Slack channel for signature
                failure or MDC corruption
              url: "{{ secret('SLACK_WEBHOOK') }}"
              payload: |
                {"text": "SECURITY ALERT: OpenPGP Signature Verification or Tamper Detected\nExecution: {{ execution.id }}\nExpected Signer: {{ inputs.expected_signer_identity }}\nStatus: Quarantined\nRemediation: Ingestion halted. Audit sender key rotation or investigate channel integrity."}
          else:
            - id: log_quarantine_suppressed
              type: io.kestra.plugin.core.log.Log
              description: Record suppressed quarantine notification
              message: "Quarantine alert suppressed by quarantine_on_tamper=false."

  - id: log_audit_cycle_summary
    type: io.kestra.plugin.core.log.Log
    description: Output final summary confirming completion of the OpenPGP
      compliance audit cycle
    message: "OpenPGP signature verification cycle completed for execution {{
      execution.id }}. Expected signer: {{ inputs.expected_signer_identity }}.
      Dry-run mode: {{ inputs.dry_run }}."

errors:
  - id: alert_on_flow_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Dispatch emergency alert if OpenPGP compliance audit flow
      encounters an unhandled runtime error
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {"text": "CRITICAL: OpenPGP Signature Integrity Gate encountered an unexpected error\nFlow: {{ flow.id }}\nExecution: {{ execution.id }}\nNamespace: {{ flow.namespace }}"}

Automate cryptographic admission control for partner and vendor data files. This blueprint verifies OpenPGP digital signatures and Modification Detection Code (MDC) integrity packets before sensitive data reaches downstream ingestion systems. Unsigned files, mismatched signer identities, or tampered bytes are intercepted and routed to quarantine alerts in Slack.

How it works

scheduled_verification_cycle (Schedule, 0 */6 * * *, disabled by default) runs periodic compliance checks across staged partner payloads.
stage_audit_payload (io.kestra.plugin.scripts.shell.Commands) stages an audit manifest batch file in Kestra internal storage.
encrypt_and_sign_payload (io.kestra.plugin.crypto.openpgp.Encrypt) encrypts the payload with the recipient public key and applies an ASCII-armored OpenPGP one-pass digital signature using the sender secret key.
decrypt_and_verify_signature (io.kestra.plugin.crypto.openpgp.Decrypt, with allowFailure: true) decrypts the payload with the recipient private key, enforces SHA-256 one-pass signature verification against trusted public keys, and asserts that the signing identity matches expected_signer_identity. RFC 9580 and RFC 4880 MDC integrity verification occurs automatically during stream decryption.
evaluate_signature_status (io.kestra.plugin.core.flow.Switch) evaluates outputs.decrypt_and_verify_signature.uri is defined. On success (VALID), log_compliance_verified confirms the cryptographic check, and check_dry_run_dispatch (If) either logs promotion via log_payload_promoted (when dry_run=false) or logs dry-run verification via log_dry_run_verified (when dry_run=true).
On failure (QUARANTINE), evaluate_quarantine_alert (If) dispatches an incident card to Slack via alert_signature_tamper if quarantine_on_tamper=true, or logs quiet suppression via log_quarantine_suppressed if quarantine_on_tamper=false.
log_audit_cycle_summary (io.kestra.plugin.core.log.Log) records the final audit summary with execution telemetry.
alert_on_flow_error (SlackIncomingWebhook) in the flow-level errors block notifies on-call teams if unexpected runtime exceptions occur.

What you get

Automated cryptographic admission control preventing unauthenticated partner data from corrupting data warehouses.
Zero-trust signature enforcement validating that files were signed by authorized keys rather than third-party actors.
Automatic Modification Detection Code (MDC) verification that rejects truncated or tampered ciphertexts.
Safe dry-run evaluation toggle and configurable quarantine Slack alerts detailing execution ID, expected signer, and security remediation guidance.

Who it's for

Data Platform Engineers building secure vendor and partner ingestion pipelines.
Security and Compliance Engineers enforcing SOC 2, HIPAA, or PCI-DSS cryptographic verification controls.
Financial and Healthcare data custodians handling confidential exchange payloads.

Why orchestrate this with Kestra

Declarative OpenPGP cryptography without managing complex local GnuPG keyrings on worker nodes.
Built-in failure tolerance and conditional branching allowing graceful quarantine routing instead of opaque pipeline crashes.
Native Kestra internal storage streams encrypted files directly through Bouncy Castle memory buffers without writing cleartext to local disk.
Centralized audit trail with execution history and tamper alerting out of the box.

Prerequisites

Kestra 0.18.0 or later with plugin-crypto and plugin-slack available.
An OpenPGP key pair for the sender (signing) and recipient (encryption/decryption).
Slack Incoming Webhook URL for security notification dispatches.

Secrets

SLACK_WEBHOOK: Incoming Webhook URL for Slack security notifications.
PGP_RECIPIENT_PUBLIC_KEY: ASCII-armored OpenPGP public key of the receiving system (gpg --armor --export recipient@internal.example.com).
PGP_RECIPIENT_PRIVATE_KEY: ASCII-armored OpenPGP private key of the receiving system (gpg --armor --export-secret-keys recipient@internal.example.com).
PGP_RECIPIENT_PRIVATE_KEY_PASSPHRASE: Passphrase protecting the recipient private key (leave empty string if unencrypted).
PGP_SENDER_PUBLIC_KEY: ASCII-armored OpenPGP public key of the sender partner (gpg --armor --export partner-secops@vendor.example.com).
PGP_SENDER_PRIVATE_KEY: ASCII-armored OpenPGP private key of the sender partner for signing.
PGP_SENDER_PRIVATE_KEY_PASSPHRASE: Passphrase protecting the sender signing private key.

For open-source (OSS) Kestra setups, provide secrets as base64-encoded environment variables:

export SECRET_SLACK_WEBHOOK=$(echo -n "https://hooks.slack.com/services/T00/B00/XXXX" | base64)
export SECRET_PGP_RECIPIENT_PUBLIC_KEY=$(echo -n "-----BEGIN PGP PUBLIC KEY BLOCK-----..." | base64)
export SECRET_PGP_RECIPIENT_PRIVATE_KEY=$(echo -n "-----BEGIN PGP PRIVATE KEY BLOCK-----..." | base64)
export SECRET_PGP_RECIPIENT_PRIVATE_KEY_PASSPHRASE=$(echo -n "secret-passphrase" | base64)
export SECRET_PGP_SENDER_PUBLIC_KEY=$(echo -n "-----BEGIN PGP PUBLIC KEY BLOCK-----..." | base64)
export SECRET_PGP_SENDER_PRIVATE_KEY=$(echo -n "-----BEGIN PGP PRIVATE KEY BLOCK-----..." | base64)
export SECRET_PGP_SENDER_PRIVATE_KEY_PASSPHRASE=$(echo -n "secret-passphrase" | base64)

Quick start

Generate a test GPG key pair locally using standard tools:

docker run --rm -it alpine sh -c "apk add --no-cache gnupg && gpg --batch --passphrase '' --quick-generate-key 'partner-secops@vendor.example.com' default default never && gpg --armor --export 'partner-secops@vendor.example.com'"

Configure the required secrets in Kestra KV store or environment variables.
If testing with a custom containerized mock partner SFTP or key server, avoid host port conflicts (do not use 8080):
```
docker run -d --name pgp-mock-store -p 8085:8085 alpine sh -c "while true; do sleep 3600; done"
docker network connect YOUR_KESTRA_NETWORK pgp-mock-store
```
(Run docker network ls to locate your active Kestra Docker bridge network).
Execute the flow manually in the Kestra UI to verify that the cryptographic signature and MDC integrity check succeed.
Set disabled: false on scheduled_verification_cycle to automate continuous monitoring.

How to extend

Add downstream S3 or PostgreSQL storage ingestion tasks in the VALID case to consume the verified cleartext URI ({{ outputs.decrypt_and_verify_signature.uri }}).
Connect a secondary quarantine bucket upload task in the QUARANTINE case to preserve tampered payloads for forensic analysis.
Integrate PagerDuty or Opsgenie webhooks to escalate repeated signature validation failures during automated batches.

Inputs

expected_signer_identity (STRING, default "partner-secops@vendor.example.com"): Expected signer User ID or email identity matching the key ring.
quarantine_on_tamper (SELECT: "true", "false", default "true"): Log incident telemetry and route tampered payloads to quarantine alerting.
dry_run (SELECT: "true", "false", default "true"): Audit signature verification and decryption without downstream cleartext promotion.

Outputs

stage_audit_payload.outputFiles['audit_manifest.json']: Staged audit manifest file storage URI.
encrypt_and_sign_payload.uri: Internal storage URI of the encrypted and signed OpenPGP message.
decrypt_and_verify_signature.uri: Internal storage URI of the verified decrypted cleartext payload.

Pitfalls

Keyring Armor Formatting: Keys must include full -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK----- headers and trailers.
MDC Integrity Packets: The io.kestra.plugin.crypto.openpgp.Decrypt task strictly rejects legacy unauthenticated SED packets (RFC 9580 Section 5.7). Messages must be created with integrity protection (SEIP or AEAD).
Passphrase Quoting: When using secret passphrases with special characters, always store them via {{ secret('NAME') }} to prevent Pebble template parsing errors.
User ID Binding: requiredSignerUsers validates against the primary User ID or parsed email address within angle brackets. Ensure the identity string in expected_signer_identity matches the key metadata exactly.