slauger/openshift-update-proxy

Review signals: 1 connection review.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 11 distinct locations. 9 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The /versions/v1/supported endpoint lists supported OpenShift minors with latest release per channel: Real input produced the expected result: OpenShift Container Platform

  Source: | `/versions/v1/supported` | derived from lifecycle API + update graph | Supported OpenShift minors with latest release per channel |

  Input: GET /versions/v1/supported

  Expected: JSON including the product name OpenShift Container Platform

  Command: <guest-path>

  Observed: …OpenShift Container Platform","versions":[{"channel":"stable-4.22","latest_release":"4.22.20","support_phase":"Full Support","version":"4.22"},{"channel":"stable-4.21","latest_release":"4.21.40","support_phase":"Maintenance Support","version":"4.21"},{"channel":"stable-4.20","latest_release":"4.20.44","support_phase":"Maintenance Support","version":"4.20"},{"channel":"stable-4.19","latest_release":"4.19.53","support_phase":"Maintenance Support","version":"4.19"},{"channel":"stable-4.18","latest_release":"4.18.56","support_phase":"Extended Support","version":"4.18"},{"channel":"stable-4.16","la

• LISTEN_PORT sets the listen port (default 5000): Real input produced the expected result: OpenShift Container Platform

  Source: | `LISTEN_PORT` | `5000` | Listen port |

  Input: LISTEN_PORT=5055

  Expected: server answers on port 5055

  Command: <guest-path>

  Observed: …OpenShift Container Platform","versions":[{"channel":"stable-4.22","latest_release":"4.22.20","support_phase":"Full Support","version":"4.22"},{"channel":"stable-4.21","latest_release":"4.21.40","support_phase":"Maintenance Support","version":"4.21"},{"channel":"stable-4.20","latest_release":"4.20.44","support_phase":"Maintenance Support","version":"4.20"},{"channel":"stable-4.19","latest_release":"4.19.53","support_phase":"Maintenance Support","version":"4.19"},{"channel":"stable-4.18","latest_release":"4.18.56","support_phase":"Extended Support","version":"4.18"},{"channel":"stable-4.16","la

Examples

• Run the documented test suite (make test): command completed successfully

  Source: Makefile / README.md Local Development

  Input: make test

  Expected: all tests pass

  Command: make test

  Observed: proxy/app.py 148 5 97% 156-157, 160, 231-232 src/openshift_update_proxy/cache.py 11 0 100% src/openshift_update_proxy/catalog.py 67 1 99% 104 src/openshift_update_proxy/config.py 16 0 100% src/openshift_update_proxy/graph.py 22 0 100% src/openshift_update_proxy/lifecycle.py 40 1 98% 53 ----------------------------------------------------------------------- TOTAL 317 19 94% ============================== 38 passed in 0.56s ==============================

Local or hosted: local

Run openshift-update-proxy (Flask+waitress HTTP proxy) and fetch GET /versions/v1/supported, which returns supported OpenShift minors with latest release per channel from the live upstream lifecycle and update graph APIs

cd <guest-path> && ls -la && cat README.md | head -c 7000; echo; python3 --version; echo $CDP_URL
cd <guest-path> && tail -c +7000 README.md | head -c 8000; echo; cat pyproject.toml | head -60; ls .coldpass; ls /inputs 2>/dev/null
which uv python3.14 python3.13 pip3 make 2>&1; ls <guest-path>; ls -la <guest-path>; cat <guest-path>; sudo -n true && echo SUDO_OK; cat /etc/os-release | head -2
cd <guest-path> && uv python install 3.14 2>&1 | tail -5; uv venv --python 3.14 .venv 2>&1 | tail -3; .venv/bin/python --version
cd <guest-path> && VIRTUAL_ENV=$PWD/.venv uv pip install --python .venv/bin/python -e ".[dev]" 2>&1 | tail -5
cd <guest-path> && timeout 600 make test 2>&1 | tail -25; echo EXIT=$?
cd <guest-path> && cat src/openshift_update_proxy/__main__.py; ls examples; (timeout 8 curl -sS -o /dev/null -w '%{http_code}\n' https://api.openshift.com/api/upgrades_info/v1/graph?channel=stable-4.16 2>&1 || true); ls <guest-path>
cd <guest-path> && wc -c check.py && grep -n -i "http\|health\|stays_running\|output_directory\|expected_file" check.py | head -80
cd <guest-path> && sed -n 636,690p check.py
cd <guest-path> && (LISTEN_HOST=127.0.0.1 LISTEN_PORT=5000 nohup .venv/bin/openshift-update-proxy > <guest-path> 2>&1 &) ; sleep 3; curl -sS -w '\nHTTP %{http_code}\n' http://127.0.0.1:5000/healthz; curl -sS -w '\nHTTP %{http_code}\n' 'http://127.0.0.1:5000/api/upgrades_info/v1/graph?channel=stable-4.16' | head -c 600; echo; curl -sS -w '\nHTTP %{http_code}\n' 'http://127.0.0.1:5000/versions/v1/supported' | head -c 800
pkill -f '<guest-path>' ; sleep 1; (curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:5000/healthz || echo "port 5000 free"); cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>"],"cwd":"<guest-path>","url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The /versions/v1/supported endpoint lists supported OpenShift minors with latest release per channel","source":"| `/versions/v1/supported` | derived from lifecycle API + update graph | Supported OpenShift minors with latest release per channel |","input":"GET /versions/v1/supported","expected":"JSON including the product name OpenShift Container Platform","probe_kind":"http","argv":["<guest-path>"],"url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform","cwd":"<guest-path>"},
{"kind":"claim","claim":"LISTEN_PORT sets the listen port (default 5000)","source":"| `LISTEN_PORT` | `5000` | Listen port |","input":"LISTEN_PORT=5055","expected":"server answers on port 5055","probe_kind":"http","argv":["<guest-path>"],"url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform","cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Run the documented test suite (make test)","source":"Makefile / README.md Local Development","input":"make test","expected":"all tests pass","argv":["make","test"],"cwd":"<guest-path>","env":{},"expected_text":"38 passed"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, pyproject.toml, Makefile, src/openshift_update_proxy/__main__.py. The product is a request/response Flask+waitress HTTP proxy with no built-in cron, loop, scheduler, webhook or --once/--now trigger. The only schedule found is a GitHub Actions workflow in examples/create-configmaps (CI-side), which is not product behavior."}
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool claims.json >/dev/null && python3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo JSON_OK
ps -eo pid,args | grep '[o]penshift-update-proxy' ; for p in $(ps -eo pid,args | grep '[.]venv/bin/openshift-update-proxy' | awk '{print $1}'); do kill $p; done; sleep 1; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:5000/healthz || echo "port 5000 free"; ls <guest-path>
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>"],"cwd":"<guest-path>","url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The /versions/v1/supported endpoint lists supported OpenShift minors with latest release per channel","source":"| `/versions/v1/supported` | derived from lifecycle API + update graph | Supported OpenShift minors with latest release per channel |","input":"GET /versions/v1/supported","expected":"JSON including the product name OpenShift Container Platform","probe_kind":"http","argv":["<guest-path>"],"url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform","cwd":"<guest-path>"},
{"kind":"claim","claim":"LISTEN_PORT sets the listen port (default 5000)","source":"| `LISTEN_PORT` | `5000` | Listen port |","input":"LISTEN_PORT=5055","expected":"server answers on port 5055","probe_kind":"http","argv":["<guest-path>"],"url":"http://127.0.0.1:5055/versions/v1/supported","env":{"LISTEN_HOST":"127.0.0.1","LISTEN_PORT":"5055"},"expected_text":"OpenShift Container Platform","cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Run the documented test suite (make test)","source":"Makefile / README.md Local Development","input":"make test","expected":"all tests pass","argv":["make","test"],"cwd":"<guest-path>","env":{},"expected_text":"38 passed"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, pyproject.toml, Makefile, src/openshift_update_proxy/__main__.py. The product is a request/response Flask+waitress HTTP proxy with no built-in cron, loop, scheduler, webhook or --once/--now trigger. The only schedule found is a GitHub Actions workflow in examples/create-configmaps (CI-side), which is not product behavior."}
EOF
for f in probe claims examples cycles; do python3 -m json.tool $f.json >/dev/null && echo "$f OK"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 6000; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run openshift-update-proxy (Flask+waitress HTTP proxy) and fetch GET /versions/v1/supported, which returns supported OpenShift minors with latest release per channel from the live upstream lifecycle and update graph APIs","operation_scope":"Linux guest with Python 3.14 (required by pyproject requires-python >=3.14) in a venv; outbound HTTPS to api.openshift.com and access.redhat.com; no container runtime, no Helm, no cluster, no credentials needed","steps":["uv python install 3.14 && uv venv --python 3.14 .venv (README's `python3 -m venv .venv` used the guest's Python 3.12.3, which is too old)","uv pip install --python .venv/bin/python -e \".[dev]\" (README Local Development: pip install -e \".[dev]\")","make test (38 passed)","LISTEN_HOST=127.0.0.1 LISTEN_PORT=5000 .venv/bin/openshift-update-proxy (README PyPI/Local Development entrypoint)","curl http://127.0.0.1:5000/healthz -> {\"status\":\"ok\"}; curl /versions/v1/supported -> JSON with product OpenShift Container Platform","checker --validate --replay: probe PASS on port 5055, claims PASS, example make test PASS"],"deviations":["Guest python3 is 3.12.3 but the project requires >=3.14; installed CPython 3.14.9 via uv (uv python install 3.14) and used a uv venv instead of the README's python3 -m venv. Install succeeded.","Used uv pip instead of pip inside the venv (same editable install of .[dev]).","Did not run make build / Docker/Podman container, Helm chart, or cosign verification (container tooling not required for the verified operation and not present in the guest).","Preflight reference /inputs/coldpass-preflight.py does not exist in this guest; used <guest-path> as instructed in the task.","Started a manual instance on port 5000 for observation and stopped it before validation; the checker then started its own instance on 5055."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool report.json >/dev/null && echo REPORT_OK; ls -la <guest-path>; cd <guest-path> && git status 2>/dev/null | head -2; ls