Description
Every invocation logs a WARNING per plugin ("failed verification but will be loaded anyway") whenever no Sigstore metadata is present — i.e., the normal from-source/workspace case. This reads as an error to new users, and there's no quiet knob. This is raised as a question about the preferred handling rather than a prescribed fix.
Steps to Reproduce
- Install darnit from source / as an editable workspace (no Sigstore metadata).
- Run any command (e.g.
darnit audit <path>).
- Observe a WARNING per plugin.
Expected Behavior
For an intended allow_unsigned=True configuration, plugin loading shouldn't surface per-plugin WARNING-level noise that reads as failure (exact desired behavior is for maintainers to decide).
Actual Behavior
WARNING: Plugin '<name>' failed verification but will be loaded anyway: Package '<name>' not found
- Emitted at
packages/darnit/src/darnit/core/discovery.py:53 (sibling error path at :42).
discovery.py:34 hardcodes VerificationConfig(allow_unsigned=True); :51-56 logs at WARNING unconditionally when verification fails. No quiet knob exists.
Environment
- darnit version:
main @ 86f9cfa
- Python version: 3.12 (uv-managed)
- OS: any
Additional Context
Design tension: when allow_unsigned=True is intended, a per-plugin WARNING every run reads as an error, but naively downgrading it could mask genuine tampering. Question for maintainers: preferred handling — level downgrade when allow_unsigned is intentional, warn-once, a single summary line, or a documented quiet mode?
Description
Every invocation logs a WARNING per plugin ("failed verification but will be loaded anyway") whenever no Sigstore metadata is present — i.e., the normal from-source/workspace case. This reads as an error to new users, and there's no quiet knob. This is raised as a question about the preferred handling rather than a prescribed fix.
Steps to Reproduce
darnit audit <path>).Expected Behavior
For an intended
allow_unsigned=Trueconfiguration, plugin loading shouldn't surface per-plugin WARNING-level noise that reads as failure (exact desired behavior is for maintainers to decide).Actual Behavior
packages/darnit/src/darnit/core/discovery.py:53(sibling error path at:42).discovery.py:34hardcodesVerificationConfig(allow_unsigned=True);:51-56logs at WARNING unconditionally when verification fails. No quiet knob exists.Environment
main@86f9cfaAdditional Context
Design tension: when
allow_unsigned=Trueis intended, a per-plugin WARNING every run reads as an error, but naively downgrading it could mask genuine tampering. Question for maintainers: preferred handling — level downgrade whenallow_unsignedis intentional, warn-once, a single summary line, or a documented quiet mode?