Complete RC6 supply chain gates

scripts/verify_security_exceptions.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Fail closed when a dependency-audit exception is malformed or expired."""
+
+from __future__ import annotations
+
+import argparse
+import datetime as dt
+import json
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+EXCEPTIONS_PATH = ROOT / "security" / "pip-audit-exceptions.json"
+
+
+def load_and_validate() -> tuple[dict[str, object], list[str]]:
+    payload = json.loads(EXCEPTIONS_PATH.read_text(encoding="utf-8"))
+    errors: list[str] = []
+    try:
+        review_by = dt.date.fromisoformat(str(payload["review_by"]))
+    except (KeyError, ValueError):
+        errors.append("review_by must be an ISO date")
+        review_by = dt.date.min
+    if review_by < dt.date.today():
+        errors.append(f"dependency exception review expired on {review_by.isoformat()}")
+    if payload.get("package") != "starlette":
+        errors.append("only the documented Starlette compatibility exception is allowed")
+    controls = payload.get("compensating_controls")
+    if not isinstance(controls, list) or len(controls) < 3:
+        errors.append("at least three compensating controls are required")
+    advisories = payload.get("advisories")
+    if not isinstance(advisories, list) or not advisories:
+        errors.append("at least one advisory exception is required")
+    else:
+        ids = [str(item.get("id", "")) for item in advisories if isinstance(item, dict)]
+        if len(ids) != len(set(ids)) or any(not item.startswith("PYSEC-") for item in ids):
+            errors.append("advisory IDs must be unique PYSEC identifiers")
+        for item in advisories:
+            if not isinstance(item, dict) or len(str(item.get("reason", ""))) < 30:
+                errors.append("every advisory requires a specific reason")
+                break
+    return payload, errors
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--print-ids", action="store_true")
+    args = parser.parse_args()
+    payload, errors = load_and_validate()
+    if errors:
+        for error in errors:
+            print(f"ERROR: {error}", file=sys.stderr)
+        return 1
+    if args.print_ids:
+        for item in payload["advisories"]:
+            print(item["id"])
+    else:
+        print(
+            "Dependency exceptions valid through "
+            f"{payload['review_by']} with documented compensating controls."
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())