plugin: Skip keyless verification for private third-party plugins

[ricardo-kh]

Comparable to #2223, which became ineffective in #2224.

#2209 (comment)

[wata727]

It is correct that tryKeylessVerifyChecksumsSignature returns false because the verification is being skipped.
From what I understand, returning false here will still work fine.

• Install returns a installed path and ErrPluginNotVerified

  • tflint/plugin/install.go

    Lines 170 to 172 in e599327

    	if !verified {
    	return path, ErrPluginNotVerified
    	}

• The caller init will ignore this error.

  • tflint/cmd/init.go

    Lines 53 to 60 in e599327

    	_, err = installCfg.Install()
    	if err != nil {
    	if errors.Is(err, plugin.ErrPluginNotVerified) {
    	_, _ = color.New(color.FgYellow).Fprintln(cli.outStream, `No signing key configured. Set "signing_key" to verify that the release is signed by the plugin developer`)
    	} else {
    	return fmt.Errorf("Failed to install a plugin; %w", err)
    	}
    	}

Maybe the reason is that we didn't set the err to nil here...

[ricardo-kh]

Setting the err to nil would also do the trick indeed.

[ricardo-kh]

I reverted my previous suggestion and now trying your suggestion: 08f3cde

[wata727]

Thanks!