Upload folder using huggingface_hub (part 2)

scripts/provision_local_blast.py

@@ -27,7 +27,19 @@ def digest(path):
 
 
 def download(name, target):
-    with urllib.request.urlopen(BASE + name, timeout=120) as source, target.open("wb") as out:
+    if name == "reldate.txt":
+        response = urllib.request.urlopen(
+            "https://ftp.uniprot.org/pub/databases/uniprot/current_release/knowledgebase/complete/reldate.txt",
+            timeout=120,
+        )
+    elif name == "uniprot_sprot.fasta.gz":
+        response = urllib.request.urlopen(
+            "https://ftp.uniprot.org/pub/databases/uniprot/current_release/knowledgebase/complete/uniprot_sprot.fasta.gz",
+            timeout=120,
+        )
+    else:
+        raise ValueError("Only the two fixed official Swiss-Prot resources may be downloaded")
+    with response as source, target.open("wb") as out:
         shutil.copyfileobj(source, out)
     return target
 

tests/test_local_blast.py

@@ -102,3 +102,15 @@ def test_native_reference_does_not_claim_an_ncbi_page_was_queried(monkeypatch):
         "blast": {"source": "local-blast+", "top_hit": {"accession": "P68871"}}
     }, "test-user")
     assert captured == []
+
+
+def test_reference_download_resource_allowlist(monkeypatch, tmp_path):
+    import runpy
+    module = runpy.run_path(str(Path(__file__).resolve().parents[1] / "scripts" / "provision_local_blast.py"))
+    opened = []
+    monkeypatch.setattr(module["urllib"].request, "urlopen",
+                        lambda *args, **kwargs: opened.append(args))
+    for name in ("file:///etc/passwd", "../reldate.txt", "https://example.com", "unexpected"):
+        with pytest.raises(ValueError, match="fixed official"):
+            module["download"](name, tmp_path / "unused")
+    assert opened == []