Plugins: Fix descendent frontend plugin signature validation (#28638) (#28662)

* move plugin root check to earlier in validation process

* remove comment

* only check root if necessary

(cherry picked from commit b9d71f5cdd)

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>

pkg/plugins/plugins.go

@@ -374,12 +374,6 @@ func (scanner *PluginScanner) IsBackendOnlyPlugin(pluginType string) bool {
 
 // validateSignature validates a plugin's signature.
 func (s *PluginScanner) validateSignature(plugin *PluginBase) *PluginError {
-	// For the time being, we choose to only require back-end plugins to be signed
-	// NOTE: the state is calculated again when setting metadata on the object
-	if !plugin.Backend || !s.requireSigned {
-		return nil
-	}
-
 	if plugin.Signature == PluginSignatureValid {
 		s.log.Debug("Plugin has valid signature", "id", plugin.Id)
 		return nil
@@ -404,6 +398,12 @@ func (s *PluginScanner) validateSignature(plugin *PluginBase) *PluginError {
 			"state", plugin.Signature)
 	}
 
+	// For the time being, we choose to only require back-end plugins to be signed
+	// NOTE: the state is calculated again when setting metadata on the object
+	if !plugin.Backend || !s.requireSigned {
+		return nil
+	}
+
 	switch plugin.Signature {
 	case PluginSignatureUnsigned:
 		allowUnsigned := false