feat(supply-chain): verify locked hashes against PyPI releases

.github/workflows/app-ci.yml

@@ -59,6 +59,19 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
           exit "$status"
 
+      - name: Validate PyPI release hash provenance
+        run: |
+          status=0
+          receipt="$(python scripts/ci/python_lock_registry_provenance.py --json)" || status=$?
+          printf '%s\n' "$receipt"
+          {
+            echo '### PyPI release hash provenance'
+            echo '```json'
+            printf '%s\n' "$receipt"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit "$status"
+
       - name: Install backend dependencies
         run: |
           python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-hashes.txt

backend/core/local_http.py

@@ -70,7 +70,11 @@ def validate_loopback_http_origin(value: str) -> LocalHTTPOrigin:
         safe_hostname = address.compressed
 
     try:
-        port = parsed.port or (443 if parsed.scheme == "https" else 80)
+        port = (
+            parsed.port
+            if parsed.port is not None
+            else (443 if parsed.scheme == "https" else 80)
+        )
     except ValueError as exc:
         raise LocalHTTPValidationError("local HTTP origin port is invalid") from exc
     if not 1 <= port <= 65535:

backend/tests/test_local_http.py

@@ -15,6 +15,18 @@ def test_loopback_origin_is_canonicalized() -> None:
         hostname="::1",
         port=18080,
     )
+    assert validate_loopback_http_origin("http://localhost") == LocalHTTPOrigin(
+        origin="http://localhost",
+        scheme="http",
+        hostname="localhost",
+        port=80,
+    )
+    assert validate_loopback_http_origin("https://127.0.0.1:443/") == LocalHTTPOrigin(
+        origin="https://127.0.0.1",
+        scheme="https",
+        hostname="127.0.0.1",
+        port=443,
+    )
 
 
 @pytest.mark.parametrize(
@@ -32,6 +44,64 @@ def test_loopback_origin_normalizes_malformed_parser_errors(value: str) -> None:
         validate_loopback_http_origin(value)
 
 
+@pytest.mark.parametrize(
+    "value",
+    [
+        "http://localhost:80\x00/",
+        "http://\nlocalhost/",
+    ],
+)
+def test_loopback_origin_rejects_control_characters(value: str) -> None:
+    with pytest.raises(LocalHTTPValidationError, match="control characters"):
+        validate_loopback_http_origin(value)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "ftp://localhost/",
+        "http://user:pass@localhost/",
+        "http://localhost/path",
+        "http://localhost/?query=1",
+        "http://localhost/#frag",
+        "http:///",  # No hostname
+    ],
+)
+def test_loopback_origin_rejects_invalid_components(value: str) -> None:
+    with pytest.raises(
+        LocalHTTPValidationError, match=r"must be a loopback HTTP\(S\) origin"
+    ):
+        validate_loopback_http_origin(value)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "http://example.com/",
+        "http://192.168.1.1/",
+        "http://[2001:db8::1]/",
+        "http://invalid.localhost/",
+    ],
+)
+def test_loopback_origin_rejects_non_allowlisted_hosts(value: str) -> None:
+    with pytest.raises(LocalHTTPValidationError, match="host is not allowlisted"):
+        validate_loopback_http_origin(value)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "http://localhost:-1/",
+        "http://localhost:65536/",
+        "http://localhost:abc/",
+        "http://localhost:0/",
+    ],
+)
+def test_loopback_origin_rejects_invalid_ports(value: str) -> None:
+    with pytest.raises(LocalHTTPValidationError, match="port is invalid"):
+        validate_loopback_http_origin(value)
+
+
 def test_local_request_target_preserves_safe_path_and_query() -> None:
     assert (
         validate_local_request_target("/api/emails?limit=10") == "/api/emails?limit=10"

backend/tests/test_python_lock_registry_non_vacuous.py

@@ -0,0 +1,114 @@
+"""Non-vacuous evidence contracts for PyPI lock provenance."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import runpy
+import sys
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT_PATH = REPO_ROOT / "scripts" / "ci" / "python_lock_registry_provenance.py"
+_spec = importlib.util.spec_from_file_location("python_lock_registry_non_vacuous", SCRIPT_PATH)
+assert _spec is not None and _spec.loader is not None
+registry_provenance = importlib.util.module_from_spec(_spec)
+sys.modules[_spec.name] = registry_provenance
+_spec.loader.exec_module(registry_provenance)
+
+
+def _sha() -> str:
+    """Return one deterministic SHA-256 fixture digest."""
+    return "a" * 64
+
+
+def _codes(receipt: dict[str, object]) -> set[str]:
+    """Return stable top-level violation codes from a repository receipt."""
+    return {str(item["code"]) for item in receipt["violations"]}
+
+
+def test_repository_without_hash_locks_fails_non_vacuously(tmp_path: Path) -> None:
+    """A green registry receipt must represent at least one discovered hash lock."""
+    (tmp_path / "requirements.txt").write_text("example==1.0\n", encoding="utf-8")
+
+    receipt = registry_provenance.validate_repository_registry(
+        tmp_path,
+        fetch_release=lambda project, version: {},
+    )
+
+    assert receipt["status"] == "failed"
+    assert receipt["lock_files"] == []
+    assert _codes(receipt) == {"registry-no-hash-locks"}
+
+
+class _Response:
+    """Minimal exact-origin PyPI response used by the script-entrypoint test."""
+
+    def __init__(self, url: str) -> None:
+        self.url = url
+        self.headers = {"Content-Type": "application/json"}
+        self.payload = json.dumps(
+            {
+                "info": {"name": "example", "version": "1.0"},
+                "urls": [
+                    {
+                        "packagetype": "sdist",
+                        "yanked": False,
+                        "digests": {"sha256": _sha()},
+                    }
+                ],
+            }
+        ).encode("utf-8")
+
+    def __enter__(self) -> "_Response":
+        return self
+
+    def __exit__(self, *args: Any) -> None:
+        return None
+
+    def geturl(self) -> str:
+        """Return the unchanged trusted request URL."""
+        return self.url
+
+    def read(self, size: int) -> bytes:
+        """Return a bounded response body."""
+        return self.payload[:size]
+
+
+def test_script_main_guard_runs_registry_validation(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """Executing the script as __main__ publishes a passing JSON receipt and exits zero."""
+    lock = tmp_path / "requirements-hashes.txt"
+    lock.write_text(
+        f"example==1.0 \\\n    --hash=sha256:{_sha()}\n",
+        encoding="utf-8",
+    )
+
+    class _Opener:
+        def open(self, request: urllib.request.Request, timeout: float) -> _Response:
+            return _Response(request.full_url)
+
+    monkeypatch.setattr(urllib.request, "build_opener", lambda *handlers: _Opener())
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        [
+            str(SCRIPT_PATH),
+            "--repository-root",
+            str(tmp_path),
+            "--json",
+        ],
+    )
+
+    with pytest.raises(SystemExit) as exit_info:
+        runpy.run_path(str(SCRIPT_PATH), run_name="__main__")
+
+    assert exit_info.value.code == 0
+    assert json.loads(capsys.readouterr().out)["status"] == "passed"