[eoghanriley]

Description

Allows users to call the Remove function on cli command with a tar.zst or oci artifact.

Related Issue

Fixes CLI-299

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[greptile-apps]

Greptile Summary

This PR extends bundle removal to consume local tar.zst and remote OCI artifacts, including metadata-only source inspection, signature verification, embedded Zarf package-name resolution, and corresponding CLI and library coverage.

• Adds archive-backed and OCI-backed metadata sources for removal.
• Resolves embedded Zarf package names before invoking package removal.
• Adds signature-verification controls and artifact-removal tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/cli/bundle/remove.go	Extends the remove command to accept artifact sources and configure signature verification.
pkg/bundle/remove.go	Prepares artifact metadata, verifies signatures, resolves deployed package identities, and delegates removal.
internal/artifact/local_metadata.go	Adds direct metadata and OCI-blob reads from local tar.zst archives.
internal/artifact/package_metadata.go	Fetches and validates embedded Zarf metadata used by inspection and removal.
internal/zarf/remove.go	Updates package removal to support resolved deployed Zarf package names.

Sequence Diagram

sequenceDiagram
  participant User
  participant CLI as Remove CLI
  participant Source as Artifact/OCI metadata source
  participant Verify as Signature verification
  participant Remove as Bundle remover
  User->>CLI: "uds bundle remove <artifact>"
  CLI->>Source: Read bundle definition
  CLI->>Verify: Apply verification policy
  Verify-->>CLI: Verification result
  CLI->>Source: Resolve embedded Zarf package names
  CLI->>Remove: Remove selected packages
  Remove-->>User: Removed/skipped package results

Loading

_{Reviews (4): Last reviewed commit: "fix: minimize artifact handling in remov..." | Re-trigger Greptile}

[joelmccoy]

Overall looking pretty good! Had a couple comments for consideration. Some of them might change approach a bit, but can always be deferred if you feel it is out of scope for this PR

[chance-coleman]

looks good to me