fix(assessment): establish independent release trust

tools/assessments/capability-fit.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 from pathlib import Path
 import sys
 
@@ -20,6 +21,9 @@ from govoplan_assessment import render_review, review_capability_fit  # noqa: E4
 from govoplan_release.catalog import DEFAULT_PUBLIC_BASE_URL, fetch_json  # noqa: E402
 
 
+TRUSTED_KEYRING_FILE_ENV = "GOVOPLAN_MODULE_PACKAGE_CATALOG_TRUSTED_KEYS_FILE"
+
+
 def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
     parser = argparse.ArgumentParser(
         description="Validate a fit assessment and identify conclusions needing review after release drift."
@@ -44,7 +48,17 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
         "--catalog", type=Path, help="Read a catalog from a local file."
     )
     parser.add_argument(
-        "--keyring", type=Path, help="Trusted local keyring; required with --catalog."
+        "--keyring",
+        type=Path,
+        help="Published or candidate keyring whose hash is pinned by --catalog.",
+    )
+    parser.add_argument(
+        "--trusted-keyring",
+        type=Path,
+        help=(
+            "Independently pinned local keyring used as the catalog signature trust "
+            f"root; defaults to ${TRUSTED_KEYRING_FILE_ENV}."
+        ),
     )
     parser.add_argument(
         "--workspace-root",
@@ -74,7 +88,14 @@ def main(argv: list[str] | None = None) -> int:
         raise SystemExit("--keyring is required with --catalog")
     if args.public and args.keyring is not None:
         raise SystemExit("--keyring cannot be combined with --public")
-
+    configured_trusted_keyring = os.getenv(TRUSTED_KEYRING_FILE_ENV, "").strip()
+    trusted_keyring_path = args.trusted_keyring or (
+        Path(configured_trusted_keyring) if configured_trusted_keyring else None
+    )
+    if trusted_keyring_path is None:
+        raise SystemExit(
+            f"--trusted-keyring or ${TRUSTED_KEYRING_FILE_ENV} is required"
+        )
     assessment = read_object(args.assessment, label="assessment")
     schema = read_object(args.schema, label="schema")
     if args.public:
@@ -82,18 +103,24 @@ def main(argv: list[str] | None = None) -> int:
             f"{DEFAULT_PUBLIC_BASE_URL}/catalogs/v1/channels/stable.json",
             label="catalog",
         )
-        keyring = fetch_public_json(
-            f"{DEFAULT_PUBLIC_BASE_URL}/catalogs/v1/keyring.json", label="keyring"
+        published_keyring = fetch_public_json(
+            f"{DEFAULT_PUBLIC_BASE_URL}/catalogs/v1/keyring.json",
+            label="published keyring",
         )
     else:
         catalog = read_object(args.catalog, label="catalog")
-        keyring = read_object(args.keyring, label="keyring")
+        published_keyring = read_object(args.keyring, label="published keyring")
+    trusted_keyring = read_object(
+        trusted_keyring_path,
+        label="trusted keyring",
+    )
 
     report = review_capability_fit(
         assessment=assessment,
         schema=schema,
         catalog=catalog,
-        keyring=keyring,
+        published_keyring=published_keyring,
+        trusted_keyring=trusted_keyring,
         workspace_root=None
         if args.skip_tag_provenance
         else args.workspace_root.resolve(),