pray-core 1.8.1

use crate::client_trust::home::effective_trust_home;
use crate::client_trust::policy::{best_rule, load_policy_or_default};
use crate::registry::RegistryPackageVersion;
use crate::{PrayError, PrayResult};

pub fn enforce_require_signed_packages(
    source_url: &str,
    package_name: &str,
    selected: &RegistryPackageVersion,
) -> PrayResult<()> {
    let home = effective_trust_home()?;
    let policy = load_policy_or_default(&home)?;
    let rule = best_rule(&policy, source_url);
    if !rule.require_signed_packages {
        return Ok(());
    }
    let Some(signature) = selected.signature.as_deref() else {
        return Err(PrayError::Integrity(format!(
            "trust policy requires signed packages, but {package_name} {} has no signature",
            selected.version
        )));
    };
    if signature.trim().is_empty() {
        return Err(PrayError::Integrity(format!(
            "trust policy requires signed packages, but {package_name} {} has an empty signature",
            selected.version
        )));
    }
    Ok(())
}