Prepare scoped reuse reader release with qualified content digests

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

scripts/reuse_authenticated_source_inventory.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Read-only authenticated source metadata; never read env or Kubernetes Secrets.
+
+Caller must first confirm the kubeconfig targets railiance01. Raw command
+stdout/stderr and exception text are never emitted. No credentials are needed
+beyond the caller's separately approved Kubernetes observation/exec lane.
+"""
+import argparse
+import json
+import re
+import subprocess
+from urllib.parse import urlsplit, parse_qs
+
+# SQL projects metadata only; the registration payload itself is never printed.
+POD_CODE = '''import json, sqlite3
+with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db:
+ rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall()
+ print(json.dumps(rows))
+'''
+
+
+def sanitize(rows):
+    result = []
+    for repo, name, url in rows:
+        if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo):
+            raise ValueError('invalid metadata')
+        if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name):
+            raise ValueError('invalid metadata')
+        parts = urlsplit(url)
+        # URLs are untrusted stored data; refuse userinfo/fragments and arbitrary
+        # query fields (which could contain credentials). Never echo invalid rows.
+        query = parse_qs(parts.query, keep_blank_values=True)
+        if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment
+            or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443)
+            or not (re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path)
+                    or re.fullmatch(r'/coulomb/[a-zA-Z0-9_.-]+/raw/(?:branch|commit|tag)/[a-zA-Z0-9_.-]+/registry/indexes/[a-zA-Z0-9_.-]+', parts.path))
+            or any(k != 'ref' for k in query)
+            or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))):
+            raise ValueError('unsafe metadata')
+        result.append({'repo': repo, 'auth_env': name, 'index_url': url})
+    return sorted(result, key=lambda row: row['repo'])
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--kubeconfig', required=True)
+    args = parser.parse_args()
+    try:
+        proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse',
+            'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE],
+            capture_output=True, timeout=30)
+        if proc.returncode:
+            raise RuntimeError('inventory unavailable')
+        rows = sanitize(json.loads(proc.stdout))
+    except Exception:
+        print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True}))
+        return 1
+    print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2))
+    return 0
+
+if __name__ == '__main__':
+    raise SystemExit(main())