blocked 4

scripts/mirror/check_signing_prereqs.sh

@@ -2,6 +2,10 @@
 # Verifies signing prerequisites without requiring the actual key contents.
 set -euo pipefail
 if [[ -z "${MIRROR_SIGN_KEY_B64:-}" ]]; then
+  if [[ "${REQUIRE_PROD_SIGNING:-0}" == "1" ]]; then
+    echo "[error] MIRROR_SIGN_KEY_B64 is required for production signing; set the secret before running." >&2
+    exit 2
+  fi
   echo "[warn] MIRROR_SIGN_KEY_B64 is not set; ci-sign.sh will fall back to embedded test key (non-production)." >&2
 fi
 # basic base64 sanity check