fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line

Review findings on the integrated scanner:
- An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart
  that image is marked failed and sits out full runs for 20h.
- One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase
  scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build
  repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a
  report is actually published.
- The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names
  it, and Trivy is not invoked.
- loadError clears after a full run against a good inventory.
- Every image under platform/vuln-scanner stays out of Renovate auto-merge.
- The page labels status and target state per line, and mixed acceptance reads as mixed.

The Keycloak client is still an operator action: its key must go in an existing encrypted file
that an agent must not modify. platform/vuln-scanner/README.md has the exact steps.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/vuln-scanner/src/trivy.py

@@ -5,6 +5,8 @@ import re
 import subprocess
 from urllib.parse import urlsplit
 
+from state import parse_ts
+
 log = logging.getLogger("vuln-scanner.trivy")
 
 SEVERITIES = ("CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN")
@@ -13,7 +15,11 @@ _CREDENTIAL = re.compile(
     r"|status(?: code)?:? ?(?:401|403)\b|\b40[13] (?:unauthorized|forbidden)",
     re.IGNORECASE,
 )
-_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
+# Lone surrogates too: json.loads accepts them, and they cannot be encoded as UTF-8 for the page.
+_CONTROL = re.compile(r"[\x00-\x1f\x7f\ud800-\udfff]")
+# Exact and lowercase, matching report.schema.json, whose pattern is case-sensitive: an `HTTPS://x`
+# accepted here would make the schema refuse the entire report.
+_URL_SCHEME = re.compile(r"https?://")
 
 
 class ScanFailure(Exception):
@@ -35,13 +41,18 @@ def text(value, limit=512):
 def safe_url(value):
     """value if it is a plain http(s) URL, else the empty string."""
     url = text(value, 2048)
-    if not url or url != value or re.search(r"\s", url):
+    if not url or url != value or re.search(r"\s", url) or not _URL_SCHEME.match(url):
         return ""
     try:
         parts = urlsplit(url)
     except ValueError:
         return ""
-    return url if parts.scheme.lower() in ("http", "https") and parts.netloc else ""
+    return url if parts.netloc else ""
+
+
+def registry_of(reference):
+    """The lowercase registry host (and port) of a normalised registry/repository reference."""
+    return reference.split("/", 1)[0].lower()
 
 
 def _cvss(vuln):
@@ -95,7 +106,7 @@ def parse_results(document):
 def classify_failure(registry, stderr):
     """Sort a non-zero Trivy exit into credential-required or failed. Reasons name the registry."""
     if _CREDENTIAL.search(stderr or ""):
-        return ScanFailure("credential-required", "registry " + registry + " refused anonymous access")
+        return ScanFailure("credential-required", "registry " + text(registry, 253) + " refused anonymous access")
     lines = [line.strip() for line in (stderr or "").splitlines() if line.strip()]
     return ScanFailure("failed", text(lines[-1], 400) if lines else "trivy exited with an error and no message")
 
@@ -125,9 +136,9 @@ class Runner:
             db = json.loads(result.stdout).get("VulnerabilityDB")
         except (ValueError, AttributeError):
             return None
-        if not isinstance(db, dict) or not db.get("UpdatedAt"):
-            return None
-        return {"updatedAt": db["UpdatedAt"], "version": str(db.get("Version", "unknown"))}
+        if not isinstance(db, dict) or parse_ts(db.get("UpdatedAt")) is None:
+            return None  # an unparseable timestamp is no usable database, and must not reach the report
+        return {"updatedAt": db["UpdatedAt"], "version": text(str(db.get("Version", "unknown")), 128) or "unknown"}
 
     def scan(self, reference):
         args = [
@@ -143,7 +154,7 @@ class Runner:
         if result.returncode < 0:
             raise ScanFailure("failed", "trivy killed by signal " + str(-result.returncode) + " (out of memory?)")
         if result.returncode != 0:
-            raise classify_failure(reference.split("/", 1)[0], result.stderr)
+            raise classify_failure(registry_of(reference), result.stderr)
         try:
             return json.loads(result.stdout)
         except ValueError: