Problem
Release checksum signature and GitHub attestation verification are optional by default. When tooling or fingerprint configuration is absent, the installer warns and continues.
Evidence
verify_release_attestation warns and continues if gh is unavailable unless CDIDX_REQUIRE_ATTESTATION=1.verify_checksum_signature warns and continues if gpg is unavailable or if no expected fingerprint is configured unless strict mode is enabled.
Expected behavior
Document and enforce a clear default verification policy, including whether public release installs should fail closed, how the expected GPG fingerprint is distributed, and how strict/compatibility modes are selected.
Labels
enhancement, security
Problem
Release checksum signature and GitHub attestation verification are optional by default. When tooling or fingerprint configuration is absent, the installer warns and continues.
Evidence
verify_release_attestationwarns and continues ifghis unavailable unlessCDIDX_REQUIRE_ATTESTATION=1.verify_checksum_signaturewarns and continues ifgpgis unavailable or if no expected fingerprint is configured unless strict mode is enabled.Expected behavior
Document and enforce a clear default verification policy, including whether public release installs should fail closed, how the expected GPG fingerprint is distributed, and how strict/compatibility modes are selected.
Labels
enhancement,security