fix(kms): modernize audited Alibaba SDK closure

.github/workflows/build-test-quality-gate.yml

@@ -43,10 +43,11 @@ jobs:
   kms-gateway:
     name: Isolated Alibaba and Tencent KMS gateway
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     env:
-      PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
+      PIP_INDEX_URL: https://pypi.org/simple
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
+      PYTHONPATH: ${{ github.workspace }}/yuqei-contract-platform/services/kms-gateway/src
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -57,19 +58,73 @@ jobs:
           python-version: "3.12"
           cache: pip
 
-      - name: Install isolated KMS gateway
-        working-directory: yuqei-contract-platform/services/kms-gateway
+      - name: Install pinned KMS build toolchain
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e ".[test]"
+          python -m pip install --only-binary=:all: --require-hashes \
+            --requirement yuqei-infra/requirements/kms-gateway-build-tools-py312.txt
+
+      - name: Build reproducible Alibaba compatibility wheels
+        run: |
+          mkdir -p "$RUNNER_TEMP/kms-fork-build" "$RUNNER_TEMP/kms-fork-wheels"
+          python yuqei-contract-platform/services/kms-gateway/vendor/alibaba-kms-modern/build_forks.py \
+            --work-dir "$RUNNER_TEMP/kms-fork-build" \
+            --wheel-dir "$RUNNER_TEMP/kms-fork-wheels" \
+            > "$RUNNER_TEMP/kms-fork-manifest.json"
+          python -m json.tool "$RUNNER_TEMP/kms-fork-manifest.json" > /dev/null
+
+      - name: Install hash-locked KMS dependency closure
+        run: |
+          mkdir -p "$RUNNER_TEMP/kms-runtime-inputs"
+          python -m pip download --no-build-isolation --no-deps --require-hashes \
+            --dest "$RUNNER_TEMP/kms-runtime-inputs" \
+            --requirement yuqei-infra/requirements/kms-gateway-runtime-linux-x86_64-py312.txt
+          python -m pip install --no-build-isolation --require-hashes \
+            --no-index --find-links "$RUNNER_TEMP/kms-runtime-inputs" \
+            --requirement yuqei-infra/requirements/kms-gateway-runtime-linux-x86_64-py312.txt
+          python -m pip install --no-deps "$RUNNER_TEMP/kms-fork-wheels"/*.whl
+          python -m pip install --only-binary=:all: --require-hashes \
+            --requirement yuqei-infra/requirements/kms-gateway-test-py312.txt
 
       - name: Verify both official cloud SDKs and gateway contracts
         working-directory: yuqei-contract-platform/services/kms-gateway
         run: |
-          python -c "from alibabacloud_kms_kms20160120.client import Client as AliClient; from tencentcloud.kms.v20190118.kms_client import KmsClient as TencentClient; print('cloud KMS SDK imports passed')"
+          KMS_SITE_PACKAGES="$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"
+          python vendor/verify_dependency_closure.py \
+            --project pyproject.toml \
+            --path "$KMS_SITE_PACKAGES" \
+            --forbid pyOpenSSL
+          python -c "import importlib.metadata as m, importlib.util; from alibabacloud_kms_kms20160120.client import Client as AliClient; from openapi_util.protobuf import api_pb2; from tencentcloud.kms.v20190118.kms_client import KmsClient as TencentClient; assert AliClient and TencentClient; assert m.version('alibabacloud-kms-python-sdk') == '1.1.3+yuqei.1'; assert m.version('alibabacloud-dkms-gcs') == '1.0.2+yuqei.2'; assert m.version('protobuf') == '6.33.6'; assert m.version('cryptography') == '50.0.2'; assert importlib.util.find_spec('OpenSSL') is None; request = api_pb2.EncryptRequest(KeyId='ci', Plaintext=b'payload'); assert api_pb2.EncryptRequest.FromString(request.SerializeToString()) == request"
           python -m pip check
           python -m pytest -q
 
+      - name: Audit the installed KMS environment
+        run: |
+          python -m venv "$RUNNER_TEMP/kms-audit-tool"
+          "$RUNNER_TEMP/kms-audit-tool/bin/python" -m pip install \
+            --only-binary=:all: --require-hashes \
+            --requirement yuqei-infra/requirements/kms-gateway-audit-tools-linux-x86_64-py312.txt
+          KMS_SITE_PACKAGES="$(python -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"
+          KMS_AUDIT_SITE_PACKAGES="$("$RUNNER_TEMP/kms-audit-tool/bin/python" -c 'import sysconfig; print(sysconfig.get_paths()["purelib"])')"
+          "$RUNNER_TEMP/kms-audit-tool/bin/python" -m pip_audit \
+            --strict --vulnerability-service osv --progress-spinner off \
+            --path "$KMS_SITE_PACKAGES" \
+            --format json --output "$RUNNER_TEMP/kms-pip-audit.json"
+          "$RUNNER_TEMP/kms-audit-tool/bin/python" -m pip_audit \
+            --strict --vulnerability-service osv --progress-spinner off \
+            --path "$KMS_AUDIT_SITE_PACKAGES" \
+            --format json --output "$RUNNER_TEMP/kms-audit-tool-pip-audit.json"
+
+      - name: Upload KMS dependency evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kms-gateway-dependency-evidence
+          path: |
+            ${{ runner.temp }}/kms-fork-manifest.json
+            ${{ runner.temp }}/kms-pip-audit.json
+            ${{ runner.temp }}/kms-audit-tool-pip-audit.json
+          if-no-files-found: warn
+
   python:
     name: Python tests and Contract API migration
     runs-on: ubuntu-latest