security(control-plane): pin validated HTTPS destinations for scan delivery

.github/workflows/pinned-https-coverage.yml

@@ -0,0 +1,52 @@
+name: Pinned HTTPS Coverage
+
+on:
+  pull_request:
+    branches: [develop, main]
+  push:
+    branches: [develop, main]
+
+permissions:
+  contents: read
+
+jobs:
+  exact-pinned-https-coverage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.13'
+
+      - name: Install hash-locked test dependencies
+        run: python -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-test.txt
+
+      - name: Run DNS-pinned HTTPS contracts
+        run: |
+          python -m pytest -q \
+            tests/test_pinned_https_resolution.py \
+            tests/test_pinned_https_redirects.py \
+            tests/test_pinned_https_cli_integration.py \
+            tests/test_pinned_https_validation_edges.py \
+            tests/test_pinned_https_coverage_edges.py \
+            tests/test_pinned_https_release_contract.py \
+            tests/test_ssrf_protection.py
+
+      - name: Verify exact unrounded statement coverage
+        run: |
+          python -m scripts.ci.verify_module_coverage \
+            --module appguardrail_core/pinned_https.py \
+            --test tests/test_pinned_https_resolution.py \
+            --test tests/test_pinned_https_redirects.py \
+            --test tests/test_pinned_https_cli_integration.py \
+            --test tests/test_pinned_https_validation_edges.py \
+            --test tests/test_pinned_https_coverage_edges.py \
+            --test tests/test_pinned_https_release_contract.py

CHANGELOG.d/892-pinned-control-plane-delivery.md

@@ -0,0 +1,6 @@
+### Security
+
+- Added DNS-pinned public HTTPS delivery for bearer-authenticated control-plane scan uploads, preserving the original hostname for TLS SNI and certificate verification while connecting only to the exact globally routable addresses admitted by validation.
+- Restricted credential-bearing redirects to HTTP 307 and 308, revalidated every hop, and removed `Authorization` and `Proxy-Authorization` case-insensitively whenever the normalized HTTPS origin changes.
+- Added bounded timeout, redirect-count, response-size, JSON, and non-secret error contracts plus exact statement-coverage and operator documentation for standalone, organization-service, and naruon reuse.
+- Reject ambiguous control-plane base URLs and validate receipt identifiers and deploy-blocking counts before rendering terminal output, preventing query/fragment confusion and forged control-sequence messages.

appguardrail_core/__init__.py

@@ -67,6 +67,16 @@
     parse_project_matches as parse_openssf_project_matches,
 )
 from appguardrail_core.openssf_report import augment_buyer_diligence_report
+from appguardrail_core.pinned_https import (
+    DestinationValidationError,
+    HTTPSDestination,
+    PinnedHTTPSConnection,
+    PinnedHTTPSFailure,
+    PinnedHTTPSResponse,
+    ResolvedAddress,
+    post_json_pinned_https,
+    resolve_public_https_destination,
+)
 from appguardrail_core.org_intelligence import (
     BuyerEvidenceMetric,
     BuyerEvidencePack,
@@ -146,10 +156,12 @@ def render_buyer_diligence_report(
     "CURRENT_SCHEMA_VERSION",
     "DEFAULT_RETENTION_DAYS",
     "DEPLOY_BLOCKING_SEVERITIES",
+    "DestinationValidationError",
     "DriftAssessment",
     "ExternalEngineDecision",
     "ExternalScanPlan",
     "GENESIS_EVENT_HASH",
+    "HTTPSDestination",
     "MAX_RETENTION_DAYS",
     "MIN_RETENTION_DAYS",
     "MetricResult",
@@ -158,9 +170,13 @@ def render_buyer_diligence_report(
     "OrgInventory",
     "PurgePreview",
     "PurgeReceipt",
+    "PinnedHTTPSConnection",
+    "PinnedHTTPSFailure",
+    "PinnedHTTPSResponse",
     "PullRequestGateSummary",
     "RETENTION_CATEGORIES",
     "ReportContext",
+    "ResolvedAddress",
     "RepositoryGateSummary",
     "RetentionPolicy",
     "RetentionPolicyConflict",
@@ -198,9 +214,11 @@ def render_buyer_diligence_report(
     "normalize_finding",
     "normalize_findings",
     "parse_openssf_project_matches",
+    "post_json_pinned_https",
     "recompute_event_hash",
     "render_buyer_diligence_report",
     "render_org_readiness_report",
+    "resolve_public_https_destination",
     "safe_report_snippet",
     "sanitize_audit_summary",
     "score_sale_readiness",