2 files changed, 47 insertions, 3 deletions
diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 352be781c..df4f49ff1 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -143,10 +143,22 @@ func AddPolicyEntries(policyPath string, input AddPolicyEntriesInput) error {
 	if trustType == "accept" {
 		trustType = "insecureAcceptAnything"
 	}
-
 	pubkeysfile := input.PubKeyFiles
-	if len(pubkeysfile) == 0 && trustType == "signedBy" {
-		return errors.New("at least one public key must be defined for type 'signedBy'")
+
+	// The error messages in validation failures use input.Type instead of trustType to match the user’s input.
+	switch trustType {
+	case "insecureAcceptAnything", "reject":
+		if len(pubkeysfile) != 0 {
+			return fmt.Errorf("%d public keys unexpectedly provided for trust type %v", len(pubkeysfile), input.Type)
+		}
+
+	case "signedBy":
+		if len(pubkeysfile) == 0 {
+			return errors.New("at least one public key must be defined for type 'signedBy'")
+		}
+
+	default:
+		return fmt.Errorf("unknown trust type %q", input.Type)
 	}
 
 	_, err := os.Stat(policyPath)
diff --git a/pkg/trust/policy_test.go b/pkg/trust/policy_test.go
index 1f2f585c8..c4781335f 100644
--- a/pkg/trust/policy_test.go
+++ b/pkg/trust/policy_test.go
@@ -25,6 +25,38 @@ func TestAddPolicyEntries(t *testing.T) {
 	err = os.WriteFile(policyPath, minimalPolicyJSON, 0600)
 	require.NoError(t, err)
 
+	// Invalid input:
+	for _, invalid := range []AddPolicyEntriesInput{
+		{
+			Scope:       "default",
+			Type:        "accept",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "insecureAcceptAnything",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "reject",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "signedBy",
+			PubKeyFiles: []string{}, // A key is missing
+		},
+		{
+			Scope:       "default",
+			Type:        "this-is-unknown",
+			PubKeyFiles: []string{},
+		},
+	} {
+		err := AddPolicyEntries(policyPath, invalid)
+		assert.Error(t, err, "%#v", invalid)
+	}
+
 	err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
 		Scope: "default",
 		Type:  "reject",