Move SSD source-key validation to typed Kotlin

ober

5e3ffaa088a1987df724e2662112692d8cf8ff33

diff --git a/.build.yml b/.build.yml
index 2474009..fb6e792 100644
--- a/.build.yml
+++ b/.build.yml
@@ -5,7 +5,7 @@ packages:
   - make=4.4.1-r4
 sources:
   # Build dependency: full immutable commit, mirrored in dependencies.lock.json.
-  - "https://git.sr.ht/~lisp/jerboa#f4a8b5bf5b2add10b3350766671a25742d25da0a"
+  - "https://git.sr.ht/~lisp/jerboa#56ba1dba04d4335c565d2cf50fb6b1846c5e5dec"
   # The second source is the build subject selected by the SourceHut submitter.
   - https://git.sr.ht/~lisp/jerboa-android
 tasks:
@@ -14,6 +14,6 @@ tasks:
       test "$(apk info -v chez-scheme)" = chez-scheme-10.3.0-r2
       test "$(apk info -v git)" = git-2.54.0-r0
       test "$(apk info -v make)" = make-4.4.1-r4
-      test "$(git -C ../jerboa rev-parse HEAD)" = f4a8b5bf5b2add10b3350766671a25742d25da0a
-      test "$(git -C ../jerboa rev-parse 'HEAD^{tree}')" = a44fa3d5a701ba78c4eaffb78fbd68c59ee34792
+      test "$(git -C ../jerboa rev-parse HEAD)" = 56ba1dba04d4335c565d2cf50fb6b1846c5e5dec
+      test "$(git -C ../jerboa rev-parse 'HEAD^{tree}')" = 580aa2171465ceb07ff8a972b20d071675ce1453
       JERBOA="chez --libdirs .:../jerboa/lib --script" make test
diff --git a/dependencies.lock.json b/dependencies.lock.json
index 03c047e..d7893c0 100644
--- a/dependencies.lock.json
+++ b/dependencies.lock.json
@@ -11,8 +11,8 @@
   "generator_runtime": {
     "name": "jerboa",
     "repository": "https://git.sr.ht/~lisp/jerboa",
-    "commit": "f4a8b5bf5b2add10b3350766671a25742d25da0a",
-    "tree": "a44fa3d5a701ba78c4eaffb78fbd68c59ee34792"
+    "commit": "56ba1dba04d4335c565d2cf50fb6b1846c5e5dec",
+    "tree": "580aa2171465ceb07ff8a972b20d071675ce1453"
   },
   "assurance_tools": {
     "osv_scanner": {
diff --git a/scripts/verify-supply-chain.sh b/scripts/verify-supply-chain.sh
index d234f3b..614d25c 100755
--- a/scripts/verify-supply-chain.sh
+++ b/scripts/verify-supply-chain.sh
@@ -3,8 +3,8 @@ set -eu
 
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P)
 lock="$repo/dependencies.lock.json"
-jerboa_commit=f4a8b5bf5b2add10b3350766671a25742d25da0a # gitsafe:ignore
-jerboa_tree=a44fa3d5a701ba78c4eaffb78fbd68c59ee34792 # gitsafe:ignore
+jerboa_commit=56ba1dba04d4335c565d2cf50fb6b1846c5e5dec # gitsafe:ignore
+jerboa_tree=580aa2171465ceb07ff8a972b20d071675ce1453 # gitsafe:ignore
 gradle_sha=20f1b1176237254a6fc204d8434196fa11a4cfb387567519c61556e8710aed78
 jdk_macos_sha=8fa1eff40bb637a33613b2ccb8b12c70dc3661cc22cf8e784943715769a05336
 jdk_linux_sha=d8afc263758141a66e0e3aafc321e783f7016696f4eaea067d340a269037d331
diff --git a/templates/ssd-review.ss b/templates/ssd-review.ss
index 4bb426c..a9bfaa2 100644
--- a/templates/ssd-review.ss
+++ b/templates/ssd-review.ss
@@ -734,7 +734,7 @@
 
     (typed-kotlin-file "com/sfb/ssdreview/PathSafety.kt"
       (typed-library (com sfb ssdreview)
-        (export safePathComponent safeLeaf validSourceKey)
+        (export safePathComponent safeLeaf validSourceKey validatedSourceKey)
         (def (safePathComponent (name : String)) : Bool
           (let ((n (string-length name)))
             (and (and (>= n 1) (<= n 128))
@@ -750,7 +750,12 @@
             (and (and (>= n 1) (<= n 96))
                  (and (not (equal? key "."))
                       (and (not (equal? key ".."))
-                           (string-matches-regex? key "[A-Za-z0-9][A-Za-z0-9._-]*"))))))))
+                           (string-matches-regex? key "[A-Za-z0-9][A-Za-z0-9._-]*"))))))
+        (def (validatedSourceKey (raw : String)) : (Nullable String)
+          (let ((key (string-trim raw)))
+            (if (validSourceKey key)
+              (nullable-some key)
+              (nullable-none String))))))
 
     (typed-kotlin-file "com/sfb/ssdreview/NetworkSafety.kt"
       (typed-library (com sfb ssdreview)
@@ -4224,11 +4229,6 @@
        "        return output.toByteArray()"
        "    }"
        ""
-       "    private fun validatedSourceKey(raw: String): String? {"
-       "        val key = raw.trim()"
-       "        return key.takeIf { validSourceKey(it) }"
-       "    }"
-       ""
        "    private fun sha256Hex(bytes: ByteArray): String ="
        "        MessageDigest.getInstance(\"SHA-256\").digest(bytes).joinToString(\"\") { \"%02x\".format(it) }"
        ""