[drk-ram]

What and why

capture_witness_receipt._fetch_json and check_mirrors._fetch validated the initial URL against _validate_https_url and the host allowlist, but passed the request to urllib.request.urlopen, whose default HTTPRedirectHandler follows 301/302/303/307/308 redirects to arbitrary hosts or http:// URLs without re-running the allowlist or scheme check.

This change installs a redirect handler that rejects all HTTP redirects in capture_witness_receipt._fetch_json and check_mirrors._fetch, ensuring every network fetch stays pinned to the validated HTTPS URL and allowlisted host.

Closes #173

Registry impact

• This PR does not modify any existing line under registry/

Checks

• pytest passes (pytest -q — 438 passed)
• Registry and producer files still validate (python tools/validate_registry.py and python tools/validate_producers.py — passed)
• If the anchor format or verification semantics changed, docs/anchor-format.md is updated in the same PR (N/A — anchor format unchanged)

[dinakarjs]

Reviewed exact head 6b12633c3ec96810400e16b869ba7c7260ef0248. One test-integration correction blocks approval.

tests/test_fetch_redirects.py:8–16 imports pytest and defines parametrized module-level functions, but .github/workflows/ci.yml:122 runs python -m unittest discover -s tests -v, and the CI/witness/runtime dependency locks do not install pytest. In a fresh Python 3.12 environment installed from those locks, discovery of this module fails with ModuleNotFoundError: No module named 'pytest'. In an environment where pytest is available, unittest discovery instead collects zero tests from this module. Installing pytest alone therefore does not make CI execute these security regressions.

Please convert the cases to unittest.TestCase with subTest (the smallest change consistent with CONTRIBUTING.md), or explicitly wire a pytest runner and locked dependency into CI. Verify that the actual CI discovery command executes the redirect cases and that removing either new handler makes the relevant regression fail. Adding witness POST cases alongside GET would also preserve the submission-path coverage; this is a coverage recommendation, not a separately reproduced runtime defect.

The redirect implementation held up in my bounded checks: the 20 committed cases pass under pytest; the existing capture and mirror suites pass 21 and 17 tests respectively. Independent real-loopback controls passed 36 cases across capture GET, capture POST and mirror GET, HTTP 200/301/302/303/307/308, and relative/cross-host destinations. Removing each handler in memory reproduced a second request to the redirect destination. The original HTTPS/host guards passed six direct checks; only the loopback transport tests relaxed the HTTPS guard. Ruff passes. No source was changed.

I did not run the full repository suite or establish live witness/network deployment acceptance. Hosted CI and CodeQL were awaiting authorization at inspection. Requesting changes for CI regression integration, not for a demonstrated bypass of the new redirect handler. Reviewed with OpenAI Codex.