Only enable "dummy" signature type with opt-in env variable

I don't want to even have to think about people using
this in production.

tests/test-signed-commit.sh

@@ -23,7 +23,10 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
-echo "1..10"
+echo "1..11"
+
+# This is explicitly opt in for testing
+export OSTREE_DUMMY_SIGN_ENABLED=1
 
 mkdir ${test_tmpdir}/repo
 ostree_repo_init repo --mode="archive"
@@ -51,6 +54,14 @@ COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
 ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy --verify ${COMMIT} ${DUMMYSIGN}
 echo "ok commit with dummy signing"
 
+if ${CMD_PREFIX} env -u OSTREE_DUMMY_SIGN_ENABLED ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy --verify ${COMMIT} ${DUMMYSIGN} 2>err.txt; then
+    fatal "verified dummy signature without env"
+fi
+# FIXME the error message here is broken
+#assert_file_has_content_literal err.txt 'dummy signature type is only for ostree testing'
+assert_file_has_content_literal err.txt ' No valid signatures found'
+echo "ok dummy sig requires env"
+
 # tests below require libsodium support
 if ! has_libsodium; then
     echo "ok Detached ed25519 signature # SKIP due libsodium unavailability"

tests/test-signed-pull-summary.sh

@@ -27,6 +27,9 @@ set -euo pipefail
 
 echo "1..14"
 
+# This is explicitly opt in for testing
+export OSTREE_DUMMY_SIGN_ENABLED=1
+
 repo_reinit () {
     ARGS="$*"
     cd ${test_tmpdir}

tests/test-signed-pull.sh

@@ -25,6 +25,8 @@ set -euo pipefail
 
 echo "1..11"
 
+# This is explicitly opt in for testing
+export OSTREE_DUMMY_SIGN_ENABLED=1
 setup_fake_remote_repo1 "archive"
 
 repo_mode="archive"