impl: prompt user for allowing unverified binaries to run

This happens in the following cases:
- if the deployment did not have any signatures and user decided to fallback on
  releases.coder.com but the fallback did not have any signature or we failed to download it.
- similarly if the user does not want to fallback we still ask him if he wants to run the
  unverified cli

Author: fioan89

src/main/kotlin/com/coder/toolbox/cli/CoderCLIManager.kt

@@ -182,33 +182,44 @@ class CoderCLIManager(
                 downloader.downloadSignature(showTextProgress)
             }
 
-            if (signatureResult.isNotDownloaded()) {
-                context.logger.info("Trying to download signature file from releases.coder.com")
-                signatureResult = withContext(Dispatchers.IO) {
-                    downloader.downloadReleasesSignature(buildVersion, showTextProgress)
-                }
-            }
-
-            // if we could not find any signature (404 or error) and the user wants to explicitly
-            // confirm whether we run an unsigned cli
             if (signatureResult.isNotDownloaded()) {
                 if (context.settingsStore.fallbackOnCoderForSignatures == ALLOW) {
-                    context.logger.warn("Running unsigned CLI from ${cliResult.source}")
-                    downloader.commit()
-                    return true
-                } else {
-                    val acceptsUnsignedBinary = context.ui.showYesNoPopup(
-                        context.i18n.ptrl("Security Warning"),
-                        context.i18n.pnotr("Can't verify the integrity of the Coder CLI pulled from ${cliResult.source}"),
-                        context.i18n.ptrl("Accept"),
-                        context.i18n.ptrl("Abort"),
-                    )
-
-                    if (acceptsUnsignedBinary) {
-                        downloader.commit()
-                        return true
+                    context.logger.info("Trying to download signature file from releases.coder.com")
+                    signatureResult = withContext(Dispatchers.IO) {
+                        downloader.downloadReleasesSignature(buildVersion, showTextProgress)
+                    }
+
+                    // if we could still not download it, ask the user if he accepts the risk
+                    if (signatureResult.isNotDownloaded()) {
+                        val acceptsUnsignedBinary = context.ui.showYesNoPopup(
+                            context.i18n.ptrl("Security Warning"),
+                            context.i18n.pnotr("Could not fetch any signatures for ${cliResult.source} from releases.coder.com. Would you like to run it anyway?"),
+                            context.i18n.ptrl("Accept"),
+                            context.i18n.ptrl("Abort"),
+                        )
+
+                        if (acceptsUnsignedBinary) {
+                            downloader.commit()
+                            return true
+                        } else {
+                            throw UnsignedBinaryExecutionDeniedException("Running unsigned CLI from ${cliResult.source} was denied by the user")
+                        }
                     } else {
-                        throw UnsignedBinaryExecutionDeniedException("Running unsigned CLI from ${cliResult.source} was denied by the user")
+                        // we could not fetch signatures from releases.coder.com
+                        // so we will ask the user if he wants to continue
+                        val acceptsUnsignedBinary = context.ui.showYesNoPopup(
+                            context.i18n.ptrl("Security Warning"),
+                            context.i18n.pnotr("No signatures were found for ${cliResult.source} and fallback to releases.coder.com is not allowed. Would you like to run it anyway?"),
+                            context.i18n.ptrl("Accept"),
+                            context.i18n.ptrl("Abort"),
+                        )
+
+                        if (acceptsUnsignedBinary) {
+                            downloader.commit()
+                            return true
+                        } else {
+                            throw UnsignedBinaryExecutionDeniedException("Running unsigned CLI from ${cliResult.source} was denied by the user")
+                        }
                     }
                 }
             }