Pin the uv installer, audit the lock and repin the dev core #16

Merged

tiagoagueda merged 4 commits from sec2-fixes into main

2026-10-19 10:12:42 +00:00

tiagoagueda commented

2026-10-19 07:14:59 +00:00

Owner

Fixes the one open bug / security issue of this repository (no other open issue carries either label; the rest are enhancements and documentation).

#15 (SEC2-070)

ci.yml and release.yml no longer pipe an unversioned installer into a shell: UV_VERSION and UV_INSTALLER_SHA256 (the values in postulo/postulo's ci.yml), the versioned installer is downloaded to a file, checked with sha256sum -c -, then run.
New audit job in ci.yml: exports the lock without the project and without the git-pinned postulo (not on PyPI, so --strict could not look it up; the core audits its own lock) and runs pip-audit==2.10.1 --strict, on push, pull request and a weekly cron (17 6 * * 1).
Dev group repinned to core 42be52048 and relocked (uv lock --upgrade); pip-audit over the exported lock: no known vulnerabilities.
The newer core offers seven more languages (az, be, cnr, fo, kk, nn, rm), so postulo-messages extract made their empty catalogues; the catalogue check cannot pass without them. They are Weblate's to fill.
tests/test_workflows.py holds the pin, the checksum step, the schedule and the audit. A deliberately wrong checksum failing the step is sha256sum -c behaviour and cannot be run here; the test checks the step is there.

Tests

ruff check / ruff format --check, postulo-messages extract --check, check, guard: clean. uv run pytest: 19 passed, 3 skipped (WeasyPrint needs Pango, absent on the Windows machine this ran on; CI has it).

Not done

uv run pytest -m release fails for all 23 European Union catalogues (nothing is translated yet): that is Weblate's and issue #7's, not this one's.

Closes #15

🤖 Generated with Claude Code

Fixes the one open `bug` / `security` issue of this repository (no other open issue carries either label; the rest are enhancements and documentation). ## #15 (SEC2-070) - `ci.yml` and `release.yml` no longer pipe an unversioned installer into a shell: `UV_VERSION` and `UV_INSTALLER_SHA256` (the values in postulo/postulo's `ci.yml`), the versioned installer is downloaded to a file, checked with `sha256sum -c -`, then run. - New `audit` job in `ci.yml`: exports the lock without the project and without the git-pinned `postulo` (not on PyPI, so `--strict` could not look it up; the core audits its own lock) and runs `pip-audit==2.10.1 --strict`, on push, pull request and a weekly cron (`17 6 * * 1`). - Dev group repinned to core `42be52048` and relocked (`uv lock --upgrade`); pip-audit over the exported lock: no known vulnerabilities. - The newer core offers seven more languages (az, be, cnr, fo, kk, nn, rm), so `postulo-messages extract` made their empty catalogues; the catalogue check cannot pass without them. They are Weblate's to fill. - `tests/test_workflows.py` holds the pin, the checksum step, the schedule and the audit. A deliberately wrong checksum failing the step is `sha256sum -c` behaviour and cannot be run here; the test checks the step is there. ## Tests `ruff check` / `ruff format --check`, `postulo-messages extract --check`, `check`, `guard`: clean. `uv run pytest`: 19 passed, 3 skipped (WeasyPrint needs Pango, absent on the Windows machine this ran on; CI has it). ## Not done `uv run pytest -m release` fails for all 23 European Union catalogues (nothing is translated yet): that is Weblate's and issue #7's, not this one's. Closes #15 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 2 commits

2026-10-19 07:14:59 +00:00

Repin the dev lock to the current core, pin the uv installer and audit the lock in CI acfdd1a87f

Both workflows installed uv with an unversioned `curl | sh`, so whatever the address
answered ran in CI, and nothing audited a dependency. They now download the versioned
installer and check its sha256 before running it (UV_VERSION / UV_INSTALLER_SHA256, the
values of Postulo's own workflow, postulo/postulo#790), and `ci.yml` gets an `audit` job
that exports the lock and runs a pinned `pip-audit --strict` on push, pull request and
weekly. tests/test_workflows.py holds both (a wrong checksum cannot be tested here; the
test checks that the check is there).

The dev group is repinned to core 42be52048 and relocked with `uv lock --upgrade`;
pip-audit 2.10.1 over the exported lock finds nothing. The newer core offers seven more
languages (az, be, cnr, fo, kk, nn, rm), so `postulo-messages extract` made their empty
catalogues, which the catalogue check needs; they are Weblate's to fill.

Closes #15

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Test the workflow guard so it reads a pipe into sh, not into sha256sum

CI / test (pull_request) Has been cancelled

Details

CI / Audit the locked dependencies (pull_request) Has been cancelled

Details

512f273ee4

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit

2026-10-19 07:17:15 +00:00

Test the workflow guard so it reads a curl piped into sh, not a comment or sha256sum

CI / test (pull_request) Failing after 2m12s

Details

CI / Audit the locked dependencies (pull_request) Successful in 1m38s

Details

67a424b62d

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit

2026-10-19 10:06:13 +00:00

CI: install HarfBuzz-Subset, which the relocked WeasyPrint asks for

CI / test (pull_request) Successful in 2m34s

Details

CI / Audit the locked dependencies (pull_request) Successful in 2m0s

Details

b2751ff893

The relock moved WeasyPrint to a version that warns when libharfbuzz-subset is
missing. This repository's tests turn warnings into errors, so the three PDF
tests of test_europass.py failed on the CI image, which carried Pango and
HarfBuzz but not the subsetting library. Postulo's own CI installs
libharfbuzz-subset0 beside them for the same reason; the test job and the
release job now do too.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tiagoagueda merged commit 209b154638 into main

2026-10-19 10:12:42 +00:00

tiagoagueda referenced this pull request from a commit

2026-10-19 10:12:44 +00:00

Merge pull request 'Pin the uv installer, audit the lock and repin the dev core' (#16) from sec2-fixes into main