fix(assessment): reject ambiguous trust keyrings

tools/assessments/govoplan_assessment/capability_fit.py

@@ -415,40 +415,57 @@ def validate_catalog(
 def trusted_keys_from_keyring(payload: dict[str, Any]) -> dict[str, str]:
     now = datetime.now(tz=UTC)
     result: dict[str, str] = {}
+    if "keys" not in payload:
+        if not all(
+            isinstance(key, str)
+            and key.strip()
+            and key == key.strip()
+            and isinstance(value, str)
+            and value.strip()
+            and value == value.strip()
+            for key, value in payload.items()
+        ):
+            return {}
+        return {key: value for key, value in payload.items()}
     keys = payload.get("keys")
     if not isinstance(keys, list):
-        return {
-            str(key): str(value)
-            for key, value in payload.items()
-            if str(key).strip() and str(value).strip()
-        }
+        return {}
+    seen_key_ids: set[str] = set()
     for item in keys:
         if not isinstance(item, dict):
-            continue
-        if str(item.get("status") or "active").strip().lower() in {
-            "revoked",
-            "disabled",
-            "retired",
-        }:
+            return {}
+        raw_key_id = _text(item.get("key_id"))
+        if (
+            raw_key_id is None
+            or raw_key_id != raw_key_id.strip()
+            or raw_key_id in seen_key_ids
+        ):
+            return {}
+        key_id = raw_key_id
+        seen_key_ids.add(key_id)
+        status = str(item.get("status") or "active").strip().lower()
+        if status not in {"active", "next", "revoked", "disabled", "retired"}:
+            return {}
+        if status in {"revoked", "disabled", "retired"}:
             continue
         raw_not_before = item.get("not_before")
         raw_not_after = item.get("not_after")
         not_before = _datetime(raw_not_before)
         not_after = _datetime(raw_not_after)
         if raw_not_before is not None and not_before is None:
-            continue
+            return {}
         if raw_not_after is not None and not_after is None:
-            continue
+            return {}
         if not_before is not None and now < not_before:
             continue
         if not_after is not None and now > not_after:
             continue
-        key_id = _text(item.get("key_id"))
         public_key = _text(item.get("public_key")) or _text(
             item.get("public_key_base64")
         )
-        if key_id and public_key:
-            result[key_id] = public_key
+        if public_key is None:
+            return {}
+        result[key_id] = public_key
     return result