throw if fail to setup trust repo, unless skip signature

Signed-off-by: Tuan Anh Tran <[email protected]>

Author: tuananh

src/oci.rs

@@ -84,7 +84,10 @@ async fn setup_trust_repository(cli: &Cli) -> Result<Box<dyn TrustRoot>, anyhow:
         match SigstoreTrustRoot::new(None).await {
             Ok(repo) => return Ok(Box::new(repo)),
             Err(e) => {
-                log::warn!("Failed to initialize TUF trust repository: {e}");
+                log::error!("Failed to initialize TUF trust repository: {e}");
+                if !cli.insecure_skip_signature {
+                    return Err(anyhow!("Failed to initialize TUF trust repository and signature verification is required"));
+                }
                 log::info!("Falling back to manual trust repository");
             }
         }