security: repair scanning and close stale alert sources

scripts/generate_nvs_matrix.py

@@ -317,7 +317,9 @@ def generate_nvs_binary(csv_content: str, size: int) -> bytes:
             "nvs_partition_generator", "nvs_partition_gen.py"
         )
         if os.path.isfile(gen_script):
-            subprocess.check_call([
+            # Fixed interpreter/script plus an argv list (never a shell);
+            # csv_path/bin_path are private NamedTemporaryFile paths.
+            subprocess.check_call([  # nosemgrep: dangerous-subprocess-use-tainted-env-args
                 sys.executable, gen_script, "generate",
                 csv_path, bin_path, hex(size)
             ])

scripts/occworld_retrain.py

@@ -187,7 +187,10 @@ def cmd_transformer(args: argparse.Namespace) -> None:
 
     # Load VQVAE checkpoint if provided
     if args.vqvae_checkpoint:
-        ck = torch.load(args.vqvae_checkpoint, map_location="cuda")
+        # VQ-VAE checkpoints contain tensors/state dictionaries only.
+        ck = torch.load(
+            args.vqvae_checkpoint, map_location="cuda", weights_only=True
+        )
         full_model.vae.load_state_dict(ck["state_dict"])
         log.info("Loaded VQVAE checkpoint: %s", args.vqvae_checkpoint)
     full_model.vae.eval()

scripts/occworld_server.py

@@ -198,7 +198,8 @@ def load_model(checkpoint_path: str | None = None) -> Any:
 
     if checkpoint_path and os.path.isfile(checkpoint_path):
         log.info("Loading checkpoint: %s", checkpoint_path)
-        ckpt = torch.load(checkpoint_path, map_location="cpu")
+        # OccWorld checkpoints contain tensors/state dictionaries only.
+        ckpt = torch.load(checkpoint_path, map_location="cpu", weights_only=True)
         state = ckpt.get("state_dict", ckpt)
         # Strip common "model." prefix from distributed training saves
         state = {k.removeprefix("model."): v for k, v in state.items()}

scripts/provision.py

@@ -103,7 +103,9 @@ def generate_nvs_binary(csv_content, size):
         gen_script = os.path.join(idf_path, "components", "nvs_flash",
                                   "nvs_partition_generator", "nvs_partition_gen.py")
         if os.path.isfile(gen_script):
-            subprocess.check_call([
+            # Fixed interpreter/script plus an argv list (never a shell);
+            # csv_path/bin_path are private NamedTemporaryFile paths.
+            subprocess.check_call([  # nosemgrep: dangerous-subprocess-use-tainted-env-args
                 sys.executable, gen_script, "generate",
                 csv_path, bin_path, hex(size)
             ])