mirror of
https://github.com/logos-co/logos-package-manager.git
synced 2026-08-27 10:11:07 +00:00
Dario Gabriel LipicarandClaude Opus 5
7c5aad9ae5
At the default policy (WARN) the only diagnostic was for an UNSIGNED package. A package signed by a key absent from the keyring — trusted_as empty, no active anchor validating it — installed in TOTAL SILENCE, and was indistinguishable at the terminal from one signed by a trusted key. That is the wrong silence. Unsigned is a stated, visible choice; signed by a stranger looks exactly like signed by someone you trust, which is the case a warning is actually for. Each policy level now says what it did and why: NONE no verification was performed WARN signed, but no active trust anchor validates the signer REQUIRE refused, naming the signer that no anchor covers The wording keeps DISAMBIGUATION and AUTHORIZATION apart, because the draft core specs are explicit that a bare identifier, package field, catalog entry or downloaded key establishes no trust anchor. A dependency's signer pin selects among same-named candidates; it never authorizes. This is the other half — the install-time gate that decides whether a package may be installed at all — and it reads only the keyring, never the manifest's own claim about itself. Repository::trustedSignerDids remains parsed, stored and emitted with zero read sites; wiring the per-repository anchor set to this gate is the next step and is deliberately not in this change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>