Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/bundler/attestation/verifying.go`:
- Around line 42-46: PublicGoodTrustedRoot is collapsing the structured error
code returned by trust.GetTrustedMaterial() by always wrapping failures as
ErrCodeInternal. Update the error handling in PublicGoodTrustedRoot to preserve
any existing coded error from trust.GetTrustedMaterial() and only wrap when the
error is uncoded, using errors.PropagateOrWrap or equivalent so
VerifyBinaryAttestation and default bundle verification keep the original
Unavailable, Unauthorized, or Internal classification.

In `@pkg/bundler/verifier/verifier_test.go`:
- Around line 563-588: The test currently only checks generic attestation
failure outcomes, so it can still pass even if Verify() never reaches the
TrustRoot loader path. Update TestVerify_TrustRootOption_LoaderFailure to assert
a loader-specific message in result.Errors from the
newUnionTrustedRoot/TrustedMaterial path, such as the missing trusted_root.json
path or file-not-found detail. Keep the existing TrustLevel, Errors, and
BundleAttested checks, but add a concrete expectation that proves the
opts.TrustRoot branch actually ran.

In `@pkg/bundler/verifier/verifier.go`:
- Around line 100-116: Preserve the coded error from --trust-root by moving the
private trusted root load out of newUnionTrustedRoot and into option resolution,
so LoadTrustedMaterialFromFile can fail early and return ErrCodeInvalidRequest
as-is instead of being wrapped by the attestation verifier. Update the flow
around newUnionTrustedRoot and the related option-building path to pass a
preloaded private root into the verifier, keeping verification errors for actual
bundle failures only.

In `@pkg/cli/bundle_verify_test.go`:
- Around line 195-259: The trust-root plumbing test currently asserts only the
generic “bundle attestation verification failed” banner, which is too broad. In
TestBundleVerifyCmd_TrustRootFlagPlumbing, tighten the trust-root-only case to
assert the missing trust-root loader detail from the union loader path, so the
test proves --trust-root actually reaches trust-root resolution. Keep the second
subtest focused on verifying --trust-root can coexist with --key and
--certificate-identity-regexp without a flag-parse or mutual-exclusion error,
and use the existing bundleVerifyCmd and writeParseableTrustRootFixture setup to
preserve the real command execution.

In `@pkg/trust/trust.go`:
- Around line 232-245: Reject non-regular trust-root paths in
LoadTrustedMaterialFromFile before opening the file. Add a path check using the
existing os-based flow to ensure --trust-root points to a regular file (not
FIFO, device, or other special file), and return ErrCodeInvalidRequest with a
clear message when it doesn’t. Keep the existing open/read logic and size cap
after the new validation.

In
`@tests/chainsaw/signing/bundle-attestation-private-sigstore/chainsaw-test.yaml`:
- Line 321: The negative control in the bundle verification test is not
identical to the positive path because the verify command omits the same
certificate identity regexp. Update the command in the chainsaw test so the
verification call includes the `--certificate-identity-regexp` argument used
elsewhere, while keeping the rest of the flags unchanged except for the intended
trust-root difference, and continue asserting that `bundleAttested` remains
false.

---

Outside diff comments:
In `@pkg/cli/bundle_verify.go`:
- Around line 141-147: The bundle verification path is reclassifying structured
errors from verifier.Verify as internal, which breaks bad trust-root handling.
Update the error handling in the verify command to use
errors.PropagateOrWrap(err, errCode, message) instead of always wrapping with
ErrCodeInternal, so existing structured verifier errors like invalid-request
pass through unchanged while unexpected errors are still wrapped. Use the
verifyOpts/ verifier.Verify flow in bundle_verify.go to locate the fix.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/trust/trust_test.go`:
- Around line 99-153: Move the non-regular-file validation in
LoadTrustedMaterialFromFile ahead of os.Open by checking the path with
stat/lstat first, then only opening regular files so FIFOs never get a chance to
block. Add a regression subtest in TestLoadTrustedMaterialFromFile that creates
a named pipe and verifies the function returns ErrCodeInvalidRequest for it,
alongside the existing valid/missing/malformed/empty/oversized cases.

In `@tests/chainsaw/signing/bundle-attestation-private-sigstore/run.sh`:
- Around line 319-325: The CTLog public key extraction in extract_ctlog_pubkey()
uses a GNU-only base64 decode flag, so update that decode step to be portable
across macOS and Linux by selecting the correct flag per platform or by routing
through a small cross-platform decode helper; keep the existing validation
checks for CTLOG_PUBKEY after the decode.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/trust/trust_fifo_test.go`:
- Around line 38-40: The FIFO test is silently skipping on `syscall.Mkfifo`
failure, which hides regressions in the Unix-only path. In `TestTrustFIFO` (or
the test helper that creates `fifo`), replace the `t.Skipf` fallback with a hard
test failure so broken environments surface immediately instead of bypassing the
pre-open FIFO block-path coverage. Keep the behavior focused on the existing
`syscall.Mkfifo` setup and the FIFO regression check in this test file.

In `@pkg/trust/trust.go`:
- Around line 235-250: The trust-root loading path still has a TOCTOU gap
because os.Stat(path) and os.Open(path) check different path resolutions; remove
the pre-open pathname check and validate the opened file descriptor instead,
using the trust root loader logic around os.Open and the subsequent file
handling. After opening, inspect the descriptor with file info from the open
handle and reject non-regular files there, so the regular-file guard cannot be
bypassed by swapping the pathname between calls.