[bradclawsie]

Description

When deploying an unsigned package, inform user that --skip-signature-verification must be provided on the command line if absent. The corresponding issue is for Bundles Next only.
...

Related Issue

Fixes CLI-314

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

How This Was Tested

• unit tests
• built the "quickstart" Next bundle and ran:

> CLI_FEATURES=NextMode=true ~/repos/defenseunicorns/uds-cli/build/uds bundle deploy ./uds-bundle-next-quickstart-arm64-0.1.0.tar.zst
Error: bundle signature verification is enabled but no public key or keyless verification policy is configured; configure one to verify this bundle, or if the bundle is unsigned, re-run with --skip-signature-verification

> CLI_FEATURES=NextMode=true ~/repos/defenseunicorns/uds-cli/build/uds bundle deploy ./uds-bundle-next-quickstart-arm64-0.1.0.tar.zst --skip-signature-verification

# proceeds normally

[greptile-apps]

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking user-facing accuracy issue in the new remediation message.

Findings

1.  **Mislabels Missing Verification Policy** ▶

Summary

The PR specializes bundle deployment validation errors when signature verification is enabled without a configured public-key or keyless policy.

• Adds a deployment-specific policy helper and uses it during validation and execution.
• Preserves partially constructed policies on validation errors so missing policy can be distinguished from malformed configured policy.
• Adds a unit test for the new missing-policy message.
• The new message overstates what is known by labeling the artifact unsigned before inspecting it.

_{Reviews (1) · Last reviewed commit: "fix: improve error for missing unsigned ..."}

[joelmccoy]

I don't think this message is any more helpful that the one before.

If a bundle is unsigned you literally can't provide a keyless verification policy so the first line of the message is not helpful and very confusing (and the origination of this ticket).

If a bundle is unsigned the only way you can deploy it is with --skip-signature-verification. please rework this message to be more clear. We should detect if the bundle is unsigned and then display a message like the following:

Suggested change

	return bundle.VerificationPolicy{}, errors.New("bundle signature verification is enabled but no public key or keyless verification policy is configured; configure one to verify this bundle, or if the bundle is unsigned, re-run with --skip-signature-verification")
	return bundle.VerificationPolicy{}, errors.New("bundle is not signed, if you wish to deploy this unsigned bundle re-run with --skip-signature-verification")

[bradclawsie]

New PR: #1563