[arpitjain099]

BlobDocument.Validate means to forbid a global blob policy from skipping verification, but the comparison cannot fire. SignatureVerification.VerificationLevel is a string holding the level name, while LevelSkip is a *VerificationLevel, so reflect.DeepEqual is handed two different types and is always false.

The sibling in verifier.go:253 runs the same idiom correctly, because there verificationLevel really is a *VerificationLevel returned by GetVerificationLevel. Only the blob document path compares the raw string.

There is no second gate behind it. validatePolicyCore rejects skip when trust stores or trusted identities are set, but permits it when they are absent, which is the shape that reaches this check. So a blob policy document with globalPolicy: true and level: skip validates cleanly today and ends up with every enforcement field set to skip.

Comparing against LevelSkip.Name is what the field holds, and reflect was imported only for this line so it goes too.

The new case fails on main with got <nil> from Validate, and passes here. I added the non-global case beside it, since a statement that is not the global policy is still allowed to use skip and should stay that way. The repo is green, zero failures across all packages.