ADR-013 Phase 1: signed plugin artifacts (pack/validate/keygen)

shopdb/config.py

@@ -60,6 +60,16 @@ class Config:
     # API key for the unattended PowerShell collector scripts
     COLLECTOR_API_KEY = os.environ.get('COLLECTOR_API_KEY', '')
 
+    # Trusted plugin publisher public keys (ADR-013). os.pathsep-separated PEM
+    # file paths, delivered out-of-band with the deployed config - NEVER read
+    # from the plugin shelf. Used to verify signed plugin artifacts. Empty on a
+    # site that does not adopt marketplace plugins.
+    PLUGIN_TRUSTED_KEYS = [
+        path.strip()
+        for path in os.environ.get('PLUGIN_TRUSTED_KEYS', '').split(os.pathsep)
+        if path.strip()
+    ]
+
     ZABBIX_ENABLED = os.environ.get('ZABBIX_ENABLED', 'false').lower() == 'true'
     ZABBIX_URL = os.environ.get('ZABBIX_URL', '')
     ZABBIX_TOKEN = os.environ.get('ZABBIX_TOKEN', '')