Refuse an empty --require-signature or --sign-key (closes #205)

check, fetch, gen and freshen took --require-signature or --sign-key
given an empty value, on the command line or through
MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an
unset shell variable skipped the signature check or the signing. Each
now asks whether the flag was given, as gen's --output does. An empty
fingerprint is refused as one of the wrong length, by fetch before it
requests anything; an empty --sign-key is refused, naming the flag,
before any file is read.

Model: opus-5-5

internal/cli/gen.go

@@ -29,6 +29,8 @@ var (
 		"already exists (use --force to overwrite)")
 	// errEmptyOutput indicates --output given with an empty value.
 	errEmptyOutput = errors.New("--output must not be empty")
+	// errEmptySignKey indicates --sign-key given with an empty value.
+	errEmptySignKey = errors.New("--sign-key must not be empty")
 )
 
 // reportEnumProgress renders enumeration progress until the channel
@@ -121,7 +123,8 @@ func (mfa *CLIApp) outputPath(cmd *cli.Command) (string, error) {
 }
 
 // buildScannerOptions constructs scanner options from the CLI flags and
-// the path the manifest is written to.
+// the path the manifest is written to. A --sign-key given with an empty
+// value is refused.
 func (mfa *CLIApp) buildScannerOptions(
 	cmd *cli.Command, output string,
 ) (*mfer.ScannerOptions, error) {
@@ -144,7 +147,12 @@ func (mfa *CLIApp) buildScannerOptions(
 	}
 
 	// Set up signing options if sign-key is provided
-	if signKey := cmd.String("sign-key"); signKey != "" {
+	if cmd.IsSet("sign-key") {
+		signKey := cmd.String("sign-key")
+		if signKey == "" {
+			return nil, errEmptySignKey
+		}
+
 		signing, err := mfa.signingOptions(signKey)
 		if err != nil {
 			return nil, err