PGP signing support

[raftario]

Automatically create a detached PGP signature for every uploaded mod.
This is meant to increase security, remove the need for hashes, and permit the creation of mirrors. The detached key is really small and the signature generation delay is barely noticeable.

A few things are needed for it to work :

• A private key (keys/privkey.asc file)
• The passphrase for the private key (PASSPHRASE environment variable)

The key can be generated using any tool that follows the OpenPGP standard or by running keygen with npm.

(I'm working on client side integration and on a tool to create mirrors automatically.)

Edit :
Acessing the API using /api/v1/pgpmod instead of /api/v1/mod returns a PGP cleartext signed message instead of plain JSON.
/api/v1/pgpmod only supports listing mods.
/api/v1/mod now support the pgp query parameter, which returns a signed cleartext message instead of plain JSON (ie. https://beatmods.com/api/v1/mod?status=approved&pgp

[raftario]

API signing fully implemented and working as expected.

[PlasmaPower]

It seems to me like the mod uploader and approver signing the mod is a lot more important than the server signing it. Also, what's the point in the server signing the mod, especially if it's signed before it's approved?

[raftario]

The idea came from a PR that I made to the mod installer to allow mirrors. The problem was that a mirror could easily change what was being downloaded.
The main goal is to prove that the mod comes from BeatMods and this seemed like the easiest and fastest way to do it.
Nothing stops an uploader from signing their mods btw.

[PlasmaPower]

If we're taking this approach, we should probably add a timestamp or expiration to the response.

[PlasmaPower]

The .sig file should probably be updated when the mod is edited.

[raftario]

ModService.create is used everytime the mod file changes so that would be useless.

[PlasmaPower]

My bad, I thought you were signing the metadata.

[PlasmaPower]

Looks good to me then 👍

[PlasmaPower]

LGTM but has merge conflicts