fix: return error on VerifySTHSignature/VerifySCTSignature with nil verifier

client/logclient.go

@@ -145,7 +145,7 @@ func (c *LogClient) GetSTH(ctx context.Context) (*ct.SignedTreeHead, error) {
 func (c *LogClient) VerifySTHSignature(sth ct.SignedTreeHead) error {
 	if c.Verifier == nil {
 		// Can't verify signatures without a verifier
-		return nil
+		return fmt.Errorf("cannot verify STH signature: no verifier configured")
 	}
 	return c.Verifier.VerifySTHSignature(sth)
 }
@@ -154,7 +154,7 @@ func (c *LogClient) VerifySTHSignature(sth ct.SignedTreeHead) error {
 func (c *LogClient) VerifySCTSignature(sct ct.SignedCertificateTimestamp, ctype ct.LogEntryType, certData []ct.ASN1Cert) error {
 	if c.Verifier == nil {
 		// Can't verify signatures without a verifier
-		return nil
+		return fmt.Errorf("cannot verify SCT signature: no verifier configured")
 	}
 	leaf, err := ct.MerkleTreeLeafFromRawChain(certData, ctype, sct.Timestamp)
 	if err != nil {

client/logclient_test.go

@@ -796,3 +796,21 @@ func TestGetEntryAndProofErrors(t *testing.T) {
 		})
 	}
 }
+
+func TestVerifySignaturesWithoutVerifier(t *testing.T) {
+	// Create a LogClient with nil Verifier (no public key in opts)
+	lc, err := client.New("http://localhost", nil, jsonclient.Options{})
+	if err != nil {
+		t.Fatalf("Failed to create LogClient: %v", err)
+	}
+
+	// VerifySTHSignature should return an error, not nil
+	if err := lc.VerifySTHSignature(ct.SignedTreeHead{}); err == nil {
+		t.Error("VerifySTHSignature: expected error with nil verifier, got nil")
+	}
+
+	// VerifySCTSignature should return an error, not nil
+	if err := lc.VerifySCTSignature(ct.SignedCertificateTimestamp{}, ct.X509LogEntryType, nil); err == nil {
+		t.Error("VerifySCTSignature: expected error with nil verifier, got nil")
+	}
+}