feat: LoTL trust anchor expiration checks

[peppelinux]

This pull request introduces a certificate expiry check for the LoTL (List of Trusted Lists) automation system.

It adds a new scheduled GitHub Actions workflow to run expiry checks daily, extends the CLI and documentation to support and explain these checks, and ensures that expired or not-yet-valid X.509 certificates in trust anchors, signing certificates, or published LoTLs will cause CI or publication to fail. The main changes are organized as follows:

Certificate Expiry Checking (Core Logic and CLI):

• Added a new module tools/lotl/cert_expiry.py that implements functions to check the validity of X.509 certificates in trust anchors, LoTL signing certificates, and published LoTL pointer certificates. If any are expired or not yet valid, errors are returned.
• Updated tools/lotl/cli.py to add a --check-expiry command-line option, which runs expiry checks on all relevant certificates, and a --lotl-json option to specify a published LoTL to check. The CLI now fails if any relevant certificate is expired. [1] [2] [3]
• The produce function in tools/lotl/producer.py now performs an expiry check on the signing certificate before producing artifacts, failing early if the cert is expired. [1] [2]

CI Integration and Automation:

• Added a new workflow .github/workflows/lotl-cert-expiry.yml that runs daily and on demand, checking for expired certificates in tl_entries, the LoTL signing cert, and the published LoTL.
• Updated .github/workflows/lotl-update.yml to include expiry checks during the update process, and improved the validation step description to clarify that expiry is checked. [1] [2]

Documentation Updates:

• Updated tools/lotl/README.md and task4-trust-infrastructure-api/lotl-automation-and-tl-integration.md to document the new expiry check CLI options, describe how expiry checks work in CI and scheduled jobs, and clarify that expired trust anchors or signing certificates will fail validation and publication. [1] [2] [3] [4] [5]

Settings:

• Added PUBLISHED_LOTL_JSON_URL to tools/lotl/settings.py for use as the default published LoTL URL in scheduled expiry checks.

[andrea-dintino]

All good, just keep in mind that you can also do this to inspect TLs and LoTLs:

https://trust-inspector.credimi.io/docs