Skip to content

🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리] #885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 21 commits into from
Closed

🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리] #885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
d29dbd4
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 9, 2026
2eda83a
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 9, 2026
e488119
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 9, 2026
597c6cd
test(uv): cover trusted origin port boundaries
seonghobae Aug 9, 2026
9ac59a4
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 9, 2026
4ebec0c
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 9, 2026
609073a
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 11, 2026
9028402
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 11, 2026
a5b39a9
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 11, 2026
c0918bc
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 11, 2026
fb26f4f
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 12, 2026
f6a9186
test(uv): cover explicit and malformed trusted ports
seonghobae Aug 12, 2026
10347bd
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 12, 2026
d2652b1
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 12, 2026
2920938
docs(coverage): cite CWE-346 for trusted-uv origin helper
seonghobae Aug 13, 2026
514b1db
fix(coverage): accept only bounded relative requirement includes
seonghobae Aug 13, 2026
7d0c36d
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 13, 2026
c86f9d6
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 13, 2026
36c476d
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 14, 2026
fbbf00c
test(coverage): simulate Linux x86_64 for trusted-uv version gates
github-actions[bot] Aug 14, 2026
c7b48f9
🧹 [코드 헬스 개선: 신뢰할 수 있는 UV 출처 검증 로직 분리]
seonghobae Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 21 additions & 17 deletions scripts/ci/materialize_base_python_requirements.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,26 @@ def _git(repo_root: pathlib.Path, *args: str) -> bytes:
return completed.stdout


def _verify_trusted_uv_origin(url: str) -> None:
"""Verify the final response URL remains within the trusted HTTPS origin."""
final_url = urllib.parse.urlparse(url)
try:
final_port = final_url.port
except ValueError as exc:
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
) from exc
if (
(final_url.scheme, final_url.hostname)
!= ("https", "releases.astral.sh")
or final_port not in (None, 443)
):
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
)

Comment thread
seonghobae marked this conversation as resolved.
def _download_trusted_uv_archive() -> bytes:
"""Download the fixed uv release archive through one HTTPS trust boundary."""
_install_trusted_uv_url_opener()
Expand All @@ -177,23 +197,7 @@ def _download_trusted_uv_archive() -> bytes:
"uv-x86_64-unknown-linux-gnu.tar.gz",
timeout=TRUSTED_UV_DOWNLOAD_TIMEOUT_SECONDS,
) as response:
final_url = urllib.parse.urlparse(response.geturl())
try:
final_port = final_url.port
except ValueError as exc:
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
) from exc
if (
(final_url.scheme, final_url.hostname)
!= ("https", "releases.astral.sh")
or final_port not in (None, 443)
):
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
)
_verify_trusted_uv_origin(response.geturl())
payload = bytearray()
while len(payload) <= TRUSTED_UV_DOWNLOAD_MAX_BYTES:
chunk = response.read(
Expand Down
60 changes: 30 additions & 30 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5118,7 +5118,7 @@ EOS
;;
esac
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"

cat >"$fake_gh" <<'EOF'
#!/usr/bin/env bash
Expand Down Expand Up @@ -6337,7 +6337,7 @@ else
fi
echo "scan ok with PR head content"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6460,7 +6460,7 @@ vertex_ai/fallback-one)
;;
esac
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/stale-source-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6581,7 +6581,7 @@ if [ -e "$context_file" ]; then
fi
echo "scan ok with bounded PR head backend context"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6719,7 +6719,7 @@ fi
echo "Error: unexpected changed context scan attempt $attempt" >&2
exit 71
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6924,7 +6924,7 @@ fi

echo "scan ok with non-email backend scope"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7150,7 +7150,7 @@ fi

echo "scan ok with frontend email trusted backend authorization context"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7239,7 +7239,7 @@ set -euo pipefail
echo "scan ok"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7390,7 +7390,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after a PR-head blob failure" >&2
exit 64
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7480,7 +7480,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after invalid pull request SHA metadata" >&2
exit 67
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7573,7 +7573,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after an irregular PR-head entry" >&2
exit 66
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7654,7 +7654,7 @@ set -euo pipefail
printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
exit 66
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7758,7 +7758,7 @@ if [ -e "$target_path/vendor/newsdom-api" ]; then
fi
echo "scan ok with PR head content"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7853,7 +7853,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run for unsafe changed paths" >&2
exit 65
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
cat >"$event_payload_file" <<'EOF'
Expand Down Expand Up @@ -7945,7 +7945,7 @@ child_pid=$!
printf '%s' "$child_pid" > "${FAKE_STRIX_CHILD_PID_FILE:?}"
sleep "${FAKE_STRIX_TIMEOUT_SLEEP_SECONDS:?}"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/timeout-cleanup-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8024,7 +8024,7 @@ printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
echo "vertex scan ok without external LLM_API_BASE"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/gemini-2.5-pro' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8077,7 +8077,7 @@ set -euo pipefail
echo "1" >> "${FAKE_STRIX_CALL_COUNT_FILE:?}"
sleep 30
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/total-timeout-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8148,7 +8148,7 @@ set -euo pipefail
echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
if [ -n "$strix_llm" ]; then
printf '%s' "$strix_llm" >"$strix_llm_file"
fi
Expand Down Expand Up @@ -8197,7 +8197,7 @@ set -euo pipefail
echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf 'openai-direct/gpt-5.4 $(touch %s)' "$marker_file" >"$strix_llm_file"
printf '%s' 'dummy-key' >"$llm_api_key_file"

Expand Down Expand Up @@ -8252,7 +8252,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
fi
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"

set +e
Expand Down Expand Up @@ -8302,7 +8302,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
fi
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"
printf '%s' "openai-key-should-not-reach-vertex" >"$llm_api_key_file"

Expand Down Expand Up @@ -8345,7 +8345,7 @@ set -euo pipefail
echo "unexpected strix execution" >&2
exit 99
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/ready-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8398,7 +8398,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8455,7 +8455,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8514,7 +8514,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8584,7 +8584,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8643,7 +8643,7 @@ set -euo pipefail
echo "Error: transport timeout"
exit 1
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8699,7 +8699,7 @@ set -euo pipefail
echo "Error: transport timeout"
exit 1
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8749,7 +8749,7 @@ set -euo pipefail
printf '%s\n' called >>"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8802,7 +8802,7 @@ run_absolute_outside_target_path_case() {
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down
Loading