[alexlovelltroy]

Description

This pull request introduces the new read-only openchami-validate-endpoints tool and associated versioned endpoint validation policies to the OpenCHAMI RPM. It updates packaging, documentation, and the test workflow to support endpoint validation and comparison before and after upgrades. The validator is explicitly run by operators and does not change service state, but provides structured evidence of endpoint and JWT access policy. Documentation is added to guide usage and interpretation.

Endpoint validation tooling and policies:

• Added the openchami-validate-endpoints script to the RPM and ensured it is installed into /usr/bin/ along with versioned JSON policies under /usr/share/openchami/validation/policies/. [1] [2]
• Declared python3 as a required dependency for the validator tool.
• Added comprehensive documentation in docs/endpoint-validation.md describing the validator, its usage, policy schema, and upgrade workflow.
• Updated the main README.md and docs/metadata-security.md to reference the new endpoint validator and its role in upgrade and security verification. [1] [2]

Packaging and licensing:

• Updated openchami.spec to include the validator tool and policies, and to install related documentation and license files. [1] [2]
• Added the MIT license text for OpenCHAMI to LICENSES/MIT.txt.

Test and workflow updates:

• Added a test-validator target to the Makefile for running endpoint validation tests, and updated .PHONY accordingly. [1] [2]
• Updated the GitHub Actions workflow triggers to include the validator script, policies, and spec file.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[synackd]

Two wording nits, but overall looks good. Approving with rewording comments. Tested manually.