Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Around line 2464-2465: Update the `--key` CLI option description to explicitly
state that using a KMS URI (awskms://, gcpkms://, azurekms://) will perform
network/KMS provider calls to resolve the public key (i.e., verification is not
purely offline), note potential failure modes (network errors, permission/access
denied from the KMS, and unresolved keys) and recommend fallback to a local PEM
file when offline; ensure the same clarification is added for the duplicate
`--key` occurrence noted near the `--format` option so both descriptions mention
network calls and failure modes.

In `@pkg/bundler/attestation/keyverifyidentity.go`:
- Around line 56-74: Thread the parent context into loadPEMPublicKey and enforce
a bounded deadline: change loadPEMPublicKey to accept ctx (e.g.,
loadPEMPublicKey(ctx context.Context, keyRef string)), and from
NewKeyVerificationIdentity call it with a context.WithTimeout(ctx, <reasonable
duration>) and defer cancel(); ensure the timeout-wrapped context is used for
the file open/read so hung NFS/FUSE/pipe I/O is bounded. Also update the other
call site referenced (lines ~111-124) to use the new signature and apply the
same context.WithTimeout pattern; import time and remember to call cancel().
- Around line 48-55: NewKeyVerificationIdentity is incorrectly treating
hashivault:// refs as local PEM paths; update the KMS-scheme handling so
hashivault:// is treated as a KMS URI and routed through the shared KMS
resolution path. Specifically, ensure the KMS detection used by
NewKeyVerificationIdentity (via isKMSURI in kmsidentity.go) recognizes the
"hashivault" scheme, and make any necessary updates to resolveKMSPublicKey (or
its provider mapping) so hashivault:// URIs are resolved via the KMS resolution
seam rather than file-read logic; this will keep signing/verifying parity and
prevent hashivault refs from falling into the PEM code path.

In `@pkg/bundler/attestation/kmsidentity.go`:
- Around line 54-66: isKMSURI currently does a case-sensitive prefix check so
mixed-case KMS URIs (e.g., "GCPKMS://...") are treated as local paths; change
the check to be case-insensitive by normalizing the input (e.g., lowercasing
ref) before comparing against kmsURISchemes in isKMSURI so any scheme case will
match the known schemes (keep references to isKMSURI and kmsURISchemes).

In `@pkg/bundler/attestation/kmspublickey.go`:
- Around line 58-76: The KMS call error paths currently map all errors to
ErrCodeUnavailable; detect context deadline/cancel errors from the kms.Get and
sv.PublicKey failures (e.g., via errors.Is(err, context.DeadlineExceeded) or
errors.Is(err, context.Canceled)) and return errors.WrapWithContext(...,
errors.ErrCodeTimeout, ...) instead of ErrCodeUnavailable for those cases,
preserving the existing message and context map (ctxKeySigningKey: keyURI) for
both the kms.Get error branch and the sv.PublicKey error branch.

In `@pkg/bundler/verifier/verifier.go`:
- Around line 376-379: The readBoundedFile call in verifier.go currently wraps
all errors as ErrCodeInternal (see the data, err := readBoundedFile(bundlePath,
...) block and similar blocks at other locations), which clobbers structured
pkg/errors codes like ErrCodeInvalidRequest; change the error handling to check
whether err already has a structured code (i.e., is a pkg/errors coded error)
and if so return it unchanged, otherwise wrap it with
errors.Wrap(errors.ErrCodeInternal, "failed to read sigstore bundle:
"+bundlePath, err); apply the same pattern to the other bounded-read sites
referenced (lines around 401-404 and 426-429) so existing coded errors are
propagated and only uncoded errors are re-wrapped.

---

Outside diff comments:
In `@pkg/bundler/verifier/verifier_test.go`:
- Around line 364-375: In the oversized-file test in verifier_test.go, don't
ignore the result of f.Close(): after the write loop, call err = f.Close() (or
closeErr := f.Close()) and assert it (e.g., t.Fatal or t.Fatalf with the error)
so any flush/close failures are surfaced; locate the writable temp file variable
f and replace the bare f.Close() with an error check that fails the test on
non-nil error.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Around line 2507-2510: Remove the empty line inside the blockquote that starts
with "**`--key` network behavior:**" so there are no blank lines between quoted
paragraphs (fixing markdownlint MD028); edit the blockquote in
docs/user/cli-reference.md to either join the paragraphs without an intervening
blank line or split into two separate blockquotes, ensuring no blank line
remains within any single blockquote.

In `@pkg/bundler/attestation/keyverifyidentity.go`:
- Around line 49-51: Update the exported comment for the key-based
VerificationIdentity to accurately reflect supported KMS schemes: include
"hashivault://" alongside "awskms:// | gcpkms:// | azurekms://" or replace the
explicit list with a generic reference to the shared scheme-detection used by
the --key handling (mentioning keyRef and the key-based VerificationIdentity
factory). Locate the comment around the key-based VerificationIdentity/keyRef
description in keyverifyidentity.go and edit it so maintainers/users aren't
misled about supported schemes.

In `@pkg/bundler/attestation/verifying.go`:
- Around line 124-133: The function loadSigstoreBundleBytes is treating
malformed/invalid caller-supplied bundle bytes as internal errors; change the
error codes used when protojson.Unmarshal fails and when bundle.NewBundle
returns an error from errors.ErrCodeInternal to errors.ErrCodeInvalidRequest so
these are classified as client/request validation failures; update the two
errors created around protojson.Unmarshal and bundle.NewBundle to wrap with
ErrCodeInvalidRequest while keeping the existing messages and error wrapping.

In `@pkg/bundler/verifier/verifier.go`:
- Around line 82-85: Update the VerifyOptions.Key documentation comment in
verifier.go to accurately reflect supported KMS URI schemes: either add
"hashivault://" to the listed schemes (awskms:// | gcpkms:// | azurekms:// |
hashivault://) or replace the hardcoded list with a brief note referencing the
shared KMS detection logic used by the bundler so the comment stays correct if
supported schemes change; modify the comment that describes VerifyOptions.Key to
point to the shared detection/registry or include hashivault:// as appropriate.

---

Duplicate comments:
In `@docs/user/cli-reference.md`:
- Around line 2464-2465: The summary sentence that currently claims
"Verification is fully offline — no network calls are made." must be updated to
reflect that using --key with KMS URIs (awskms://, gcpkms://, azurekms://) can
perform network calls and may fail due to network/KMS auth issues; change the
summary to state that verification is offline for local PEM public-key files but
will contact KMS for awskms://, gcpkms:// or azurekms:// keys and document the
potential failure modes (network, auth, KMS unavailability) and how it differs
from --certificate-identity-regexp; apply the same wording change to the
corresponding summary elsewhere in the file that covers lines around the second
instance.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user/cli-reference.md`:
- Around line 2186-2190: The directional reference is wrong: change the phrase
"See the [`aicr verify`](`#aicr-verify`) flags above" to reference the section
below. Update the text in the paragraph referencing the `aicr verify` anchor
(the link text `aicr verify` / anchor `#aicr-verify`) so it says "See the [`aicr
verify`](`#aicr-verify`) flags below" (or reword to "See the [`aicr
verify`](`#aicr-verify`) section" without "above") to accurately point to the
later `aicr verify` section.

In `@pkg/bundler/attestation/keylessverifyidentity.go`:
- Around line 42-49: The TrustedMaterial method on keylessVerificationIdentity
accepts a context but never checks it before calling trust.GetTrustedMaterial;
update the method signature to name the context parameter (e.g., ctx) and
immediately honor cancellation by checking ctx.Err() or selecting on ctx.Done()
and returning a wrapped context.Canceled/Err if cancelled, before invoking
trust.GetTrustedMaterial so you avoid doing work after cancellation; keep the
existing error wrapping behavior for trust.GetTrustedMaterial failures.

In `@pkg/bundler/attestation/keyverifyidentity.go`:
- Around line 56-67: The stored identity in NewKeyVerificationIdentity is using
the caller-provided keyRef (preserving casing) which can cause mismatches; when
isKMSURI(keyRef) is true, canonicalize the URI scheme before saving by passing
keyRef through normalizeURIScheme (or equivalent) and set
keyVerificationIdentity.identity to that normalized value; also ensure the
signing-side NewKMSIdentity uses the same normalizeURIScheme normalization so
both signing (NewKMSIdentity) and verification (NewKeyVerificationIdentity)
store identical canonical URIs.

In `@pkg/bundler/attestation/verifying_test.go`:
- Around line 130-151: Add a positive test case to TestSignerIdentityFromResult
that exercises the successful extraction path: in the tests slice, add an entry
where result is a *verify.VerificationResult containing a non-nil Signature
(verify.SignatureVerificationResult) whose Certificate has a SAN (e.g. DNS or
URI field populated) and set want to the expected SAN string; this will call
signerIdentityFromResult and verify it returns the populated SAN instead of an
empty string. Ensure you reference the existing test harness
(TestSignerIdentityFromResult) and the types verify.VerificationResult,
verify.SignatureVerificationResult, and signerIdentityFromResult when adding the
new case.

In `@pkg/bundler/attestation/verifying.go`:
- Around line 156-166: The current containsCertChainError function is too broad
because the plain "x509" token matches unrelated errors; remove the generic
"x509" entry from staleIndicators and instead only treat x509-related messages
as stale-root when they include a specific certificate chain indicator (e.g.,
require both "x509" and "signed by unknown authority" or another explicit
phrase). Update containsCertChainError (and its loop over staleIndicators) so
the generic "x509" is not matched alone and add a separate conditional that
returns true only when the lowercased error string contains "x509" plus a
specific chain-failure phrase like "signed by unknown authority" to avoid
mislabeling expiry and other non-root issues.

In `@pkg/cli/bundle_verify_test.go`:
- Around line 69-77: The test TestBundleVerifyCmd_KeyFlagPlumbing currently uses
an empty directory so it never reaches the key-verification branch; update the
fixture used in that test (and the similar case at lines 97-113) to point to a
bundle directory that contains valid checksums and includes a bundle attestation
file so verification proceeds to attestation validation, then keep the
verifyOpts.Key = cmd.String("key") plumbing and assert that the returned error
is the key-resolution/verification error (i.e., from resolving/validating the
key) rather than a missing-checksums error; locate the test by
TestBundleVerifyCmd_KeyFlagPlumbing and the verifyOpts.Key assignment to modify
the fixture and adjust the expected error assertions accordingly.

---

Outside diff comments:
In `@pkg/bundler/verifier/verifier_test.go`:
- Around line 364-376: The test writes an oversized file but ignores the
f.Close() error; update the test in verifier_test.go to capture and check
closeErr after f.Close() (e.g., closeErr := f.Close()) and if closeErr != nil
and there is no prior fatal error, call t.Fatal or t.Fatalf to fail the test;
reference the os.File variable f and ensure the Close() error is
propagated/checked according to the writable-handle guideline.

---

Duplicate comments:
In `@docs/user/cli-reference.md`:
- Around line 2507-2510: In the docs/user/cli-reference.md blockquote that
starts with "**`--key` network behavior:**", remove the blank line inside the
blockquote (the empty line after the first paragraph) so the entire blockquote
has no internal blank lines (resolving markdownlint MD028); locate the paragraph
by its opening text and delete the stray empty line to match the previous
corrected instance.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@pkg/cli/bundle_verify.go`:
- Around line 133-139: The current error handling after calling
verifier.Verify(ctx, absDir, verifyOpts) always wraps errors with
errors.ErrCodeInternal, losing structured verifier error codes for --key
failures; change the return to use errors.PropagateOrWrap(err,
errors.ErrCodeInternal, "bundle verification failed") (or the equivalent
PropagateOrWrap API used in the codebase) so that if the verifier returned a
coded/structured error it's propagated as-is, otherwise it is wrapped with
ErrCodeInternal and the "bundle verification failed" message; reference
verifyOpts.Key and verifier.Verify to locate the call site and replace the
unconditional errors.Wrap usage accordingly.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@pkg/bundler/verifier/verifier_test.go`:
- Around line 364-376: The test TestReadBoundedFile_OversizedFile currently
ignores the error returned by f.Close(); change the code to capture and check
the Close() error (e.g., closeErr := f.Close()) and fail the test if Close()
returns an error (or propagate it if a previous error variable is used),
ensuring any flush/write failures on the temp file are detected; update
references around the variable f in verifier_test.go accordingly.

In `@pkg/cli/bundle_verify.go`:
- Around line 124-134: Detect and reject an explicitly empty or whitespace
`--key` instead of letting it silently fall back to keyless verification: after
reading the flag value from cmd.String("key"), use strings.TrimSpace on that
value and if it is empty AND the flag was explicitly provided (using the CLI's
flag-present check, e.g., cmd.IsSet("key") or equivalent), return an error; only
assign verifyOpts.Key when the trimmed value is non-empty. This change affects
the verifyOpts assignment in the VerifyOptions construction (verifyOpts,
VerifyOptions, verifyOpts.Key, cmd.String("key")).

---

Duplicate comments:
In `@docs/user/cli-reference.md`:
- Around line 2507-2511: The blockquote that starts with "**`--key` network
behavior:**" contains an empty ">" line between paragraphs triggering MD028;
remove that blank blockquote marker (or merge the two paragraphs into one) so
there is no blank ">" line between them, or alternatively split them into two
separate blockquotes if you want distinct quotes; ensure the resulting text no
longer contains an isolated ">" line inside that blockquote.