From 41e5a85567efe8c1fcd014a0d81c9415042e6c4a Mon Sep 17 00:00:00 2001 From: yuqei Date: Wed, 12 Aug 2026 22:00:35 +0800 Subject: [PATCH] ci: document fixed policy verifier subprocess --- .../contract-api/src/yuqei_contract_api/public_policies.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/public_policies.py b/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/public_policies.py index 80efa5db..f54ab117 100644 --- a/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/public_policies.py +++ b/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/public_policies.py @@ -3,7 +3,8 @@ from __future__ import annotations import hashlib import json import re -import subprocess +# The verifier runs via a fixed Python interpreter and never invokes a shell. +import subprocess # nosec B404 import sys from datetime import UTC, datetime from pathlib import Path @@ -602,7 +603,8 @@ def _run_policy_verifier(*, policy_dir: Path, approval_file: Path, keyring_file: script = next((candidate for candidate in candidates if candidate.is_file()), None) if script is None: raise PublicPolicyError("Policy verifier is unavailable.") - completed = subprocess.run( + # The executable and script are fixed; evidence paths remain plain argv values. + completed = subprocess.run( # nosec B603 [sys.executable, str(script), "verify", "--approval-file", str(approval_file), "--keyring-file", str(keyring_file), "--policy-dir", str(policy_dir), "--checked-at", _as_utc(checked_at).isoformat()], check=False, capture_output=True, text=True, timeout=20, )